Azure / Azure/bicep-types-az

underministic privileged identity management deployments

Open
#2,065 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Authorization Service Attention
Dominant language
TypeScript
Stars
108
Forks
44
Avg merge
18h 53m
Merged PRs (30d)
29

Description

Bicep version
Bicep CLI version 0.25.53 (c0ad57dff6)

Describe the bug
We're trying to incorporate privileged identity management in deployment of subscriptions to our product teams. We want to deploy the ability for developers to activate contributor permissions at the subscription level. Changes to our access structure would mean redeployment of templates. They need to be idempotent for this to work properly (as most azure resources already are).
As of now, consecutive deployments of privileged identity management assignments fails with conflict after the initial deploy.

To Reproduce
deploy the bicep file twice on subscription level with az bicep deployment sub create

var contributor_role = resourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')

@description('object id of principal that should have eligibility for contributor permissions')
param ownerId string = '[REDACTED]'


param startTime string = utcNow()

resource owner_contributor_ligibility 'Microsoft.Authorization/roleEligibilityScheduleRequests@2022-04-01-preview' = {
  name: guid(contributor_role, ownerId) // note that this does not change between deployments
  properties: {
    principalId: ownerId
    requestType: 'AdminUpdate'
    roleDefinitionId: contributor_role
    scheduleInfo: {
      expiration: {
        duration: 'P365D'
        type: 'AfterDuration'
      }
      startDateTime: startTime
    }
  }
}

Additional context
consecutive deployments yield the following error:

{
  "code": "Conflict",
  "message": "A role assignment request with Id: 7aede46e-bf0f-5b59-966c-48ccd70209b2 already exists",
  "target": "/subscriptions/[REDACTED]/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/7aede46e-bf0f-5b59-966c-48ccd70209b2"
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided Bicep resource and reproduce the issue by running the subscription deployment twice with az bicep deployment sub create. Investigate the Microsoft.Authorization/roleEligibilityScheduleRequests@2022-04-01-preview behavior for repeated AdminUpdate requests with the same name and confirm what idempotent behavior should look like.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.