Azure / Azure/bicep

InvalidRoleAssignmentId Error when following FQRID best practice

Open
#8,737 8 comments 1 reaction 0 assignees View on GitHub
error-message provider improvement troubleshooting
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

Trying several ways to specify a roleDefinitionId property on a RoleAssignment resource, I keep getting:
`InvalidRoleAssignmentId: The role assignment ID must be a GUID`

This is a very simplified template that I used to reproduce the error:

```bicep
resource roleDef 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
name: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
scope: subscription()
}

resource uami 'Microsoft.ManagedIdentity/userAssignedIdentities@2022-01-31-preview' = {
name: 'test-uami'
location: 'uksouth'
}

resource uamiRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: 'test-ra'
properties: {
principalId: uami.id
roleDefinitionId: roleDef.id
principalType: 'ServicePrincipal' //with and without
}

}
```

Variations of roleDefinitionId attempted with the same result:

- resourceId('/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
- '/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/Contributor'
- '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
- '/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
- 'b24988ac-6180-42a0-ab88-20f7382dd24c'
- subscriptionResourceId('roleDefinition', '/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c')

Any assistance appreciated. A reference to a sample doing this successfully as well.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the InvalidRoleAssignmentId error with the simplified Bicep template and compare each listed roleDefinitionId variation. Review the role assignment and role definition resource declarations; done means identifying and documenting a valid configuration or confirming the issue's expected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.