InvalidRoleAssignmentId Error when following FQRID best practice
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
Trying several ways to specify a roleDefinitionId property on a RoleAssignment resource, I keep getting:
`InvalidRoleAssignmentId: The role assignment ID must be a GUID`
This is a very simplified template that I used to reproduce the error:
```bicep
resource roleDef 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
name: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
scope: subscription()
}
resource uami 'Microsoft.ManagedIdentity/userAssignedIdentities@2022-01-31-preview' = {
name: 'test-uami'
location: 'uksouth'
}
resource uamiRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: 'test-ra'
properties: {
principalId: uami.id
roleDefinitionId: roleDef.id
principalType: 'ServicePrincipal' //with and without
}
}
```
Variations of roleDefinitionId attempted with the same result:
- resourceId('/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
- '/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/Contributor'
- '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
- '/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
- 'b24988ac-6180-42a0-ab88-20f7382dd24c'
- subscriptionResourceId('roleDefinition', '/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c')
Any assistance appreciated. A reference to a sample doing this successfully as well.
Contributor guide
Research direction
Start by reproducing the InvalidRoleAssignmentId error with the simplified Bicep template and compare each listed roleDefinitionId variation. Review the role assignment and role definition resource declarations; done means identifying and documenting a valid configuration or confirming the issue's expected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authorization, cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100