Azure / Azure/bicep

Microsoft Sentinel - Playbook Permissions aka. Microsoft.Security uses random role assignment IDs

Open
#10,564 8 comments 0 reactions 0 assignees View on GitHub
new function revisit
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Bicep version**
Not related to bicep version.

**Describe the bug**
Microsoft Sentinel - Playbook Permissions creates random role assignment IDs. This makes picking up/ importing those role assignments in bicep impossible (as bicep expects deterministic resource names.)

**To Reproduce**
Steps to reproduce the behavior:
1. Select an existing Sentinel workspace in Azure Portal
2. Navigate "Setting"
3. Select the "Settings" tab
4. Open "Playbook permissions"
5. Open "Configure permission"
6. Select a scope and create the permission with "Apply"
7. Lookup the role assignment ID that has been created in RBAC for the selected scope
8. Note down the role assignment ID
9. Delete the RBAC assignment
10. Repeat the steps from 1. - 7.
11. Note down the role assignment ID
12. Compare the role assignment IDs form 8. and 11.
=> Role Assignment IDs are different/ non deterministic.

Contributor guide

Open the contributing guide

Research direction

No repository file or test is named. Start by reproducing the issue through Azure Portal's Sentinel workspace > Settings > Playbook permissions flow, then compare the RBAC role assignment IDs after deleting and recreating the permission. Done means the resulting assignment can be picked up or imported in Bicep using a deterministic resource name.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.