arcus-azure / arcus-azure/arcus.scripting
Provide functionality to assign a role to a resource group based on the ObjectId
- Dominant language
- PowerShell
- Stars
- 10
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
Currently, the script `New-AzResourceGroupRoleAssignment` allows you to assign a role to a specific resource group for a resource/service.
While this is a start, one could also require the capability of assigning a specific role to a resource group in name of a user/group/...
In this case, it would be interesting to provide the capability to pass along an ObjectId instead of the resourceGroupName/resourceName-combination
**Describe the solution you'd like**
Can we extend the current function `New-AzResourceGroupRoleAssignment` to allow either passing along the `ObjectId` OR the `ResourceGroupName`/`ResourceName`-combo?
Using a ParameterSetName we should be able to force the user to either provide the ObjectId or the ResourceGroupName/ResourceName.
Meaning the script will either perform the lookup for ObjectId itself (if it's a resource/service), or use the provided ObjectId to assign a new role.
**Describe alternatives you've considered**
Alternately, this would mean having a separate script to make this possible.
**Additional context**
We might have to modify the parameter-definition to something as follows (based on a first quick test): _see below_.
However, I would've hoped it to be possible to keep the exception-throwing as part of the parameter-definition in itself. (--> to be investigated)
```powershell
[CmdletBinding(DefaultParametersetName='None')]
param (
[Parameter(Mandatory = $true)][string] $TargetResourceGroupName = $(throw "Target resource group name to which access should be granted is required"),
[Parameter(ParameterSetName='Resource',Mandatory = $true)][string] $ResourceGroupName,
[Parameter(ParameterSetName='Resource',Mandatory = $true)][string] $ResourceName,
[Parameter(Mandatory = $true)][string] $RoleDefinitionName = $(throw "Name of the role definition is required"),
[Parameter(ParameterSetName='Object',Mandatory = $true)][string] $ObjectId
)
$ParamSetName = $PsCmdLet.ParameterSetName
if($ParamSetName -eq 'Resource')
{
if(-not($ResourceGroupName))
{
throw "Resource group name where the resource is located which should be granted access is required"
}
if(-not($ResourceName))
{
throw "Name of the resource which should be granted access is required"
}
}
elseif($ParamSetName -eq 'Object')
{
if(-not($ObjectId))
{
throw "The ObjectId of the resource that needs to get a role assigned."
}
}
else
{
throw "Please provide either the ObjectId- or the ResourceGroupName/ResourceName-parameters."
}
```
Contributor guide
Research direction
Start by inspecting the New-AzResourceGroupRoleAssignment script and its current parameter definition. Compare the existing ResourceGroupName/ResourceName lookup path with the requested ObjectId path, then verify that parameter sets enforce either input form and that both paths assign the requested role correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- authorization, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100