Azure / Azure/bicep

Management Group deployment not working with RBAC.

Open
#6,832 4 comments 1 reaction 0 assignees View on GitHub
investigate provider improvement
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Bicep version**
0.4.1318

**Describe the bug**
We have a template that is creating a management group, and then a module to assign RBAC at the management group level. The management group creation is fine, however when the RBAC module runs with the scope set to the management group that has just been created, it fails with the error - ManagementGroupNotFound - The management group 'EXAMPLEMG' cannot be found.

There is an implicit dependency ensuring that the management group resource is created, before the module is ran assigning the RBAC to the management group. At first we thought this may be a bug with the management group set as the scope for the RBAC module.

However, if we use a management group that already exists, everything works nicely. Therefore it looks to be an issue with the implicit dependency and it doesn't seem to be creating the management group first, before moving onto the RBAC module that should run in sequence afterwards.

**To Reproduce**
Steps to reproduce the behavior:

We currently have all of our templates and modules stored here > https://github.com/Azure/ResourceModules/tree/main/arm/Microsoft.Management/managementGroups
When executing the deployment with the following command, the error should appear:

Test-AzManagementGroupDeployment -TemplateParameterFile .\Microsoft.Management\managementGroups\.parameters\parameters.json' -TemplateFile '.\Microsoft.Management\managementGroups\deploy.bicep' -Verbose -ManagementGroupId '<>' -Location 'WestEurope'

using the standard parameter file.

Additional details:

We do have other modules that assign RBAC at a management group level and they look identical, and work perfectly fine. However when the combination of creating the management group and then assigning RBAC at the newly created management group takes place, the error appears.

Contributor guide

Open the contributing guide

Research direction

Start with the Bicep templates and modules under arm/Microsoft.Management/managementGroups, using deploy.bicep and the standard parameters file referenced in the report. Run Test-AzManagementGroupDeployment with the shown arguments and compare deployment ordering when the management group is newly created versus existing. Done means RBAC assignment succeeds against the newly created management group without ManagementGroupNotFound.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.