feat: update RBAC schema in avm/res/container-registry/registry

avm/res/container-registry/registry/README.md

@@ -361,11 +361,13 @@ module registry 'br/public:avm/res/container-registry/registry:<version>' = {
  ]
  roleAssignments: [
  {
+ name: '60395919-cfd3-47bf-8349-775ddebb255e'
  principalId: '<principalId>'
  principalType: 'ServicePrincipal'
  roleDefinitionIdOrName: 'Owner'
  }
  {
+ name: '<name>'
  principalId: '<principalId>'
  principalType: 'ServicePrincipal'
  roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
@@ -499,11 +501,13 @@ module registry 'br/public:avm/res/container-registry/registry:<version>' = {
  "roleAssignments": {
  "value": [
  {
+ "name": "60395919-cfd3-47bf-8349-775ddebb255e",
  "principalId": "<principalId>",
  "principalType": "ServicePrincipal",
  "roleDefinitionIdOrName": "Owner"
  },
  {
+ "name": "<name>",
  "principalId": "<principalId>",
  "principalType": "ServicePrincipal",
  "roleDefinitionIdOrName": "b24988ac-6180-42a0-ab88-20f7382dd24c"
@@ -1471,6 +1475,7 @@ Array of role assignments to create.
 | [`conditionVersion`](#parameter-privateendpointsroleassignmentsconditionversion) | string | Version of the condition. |
 | [`delegatedManagedIdentityResourceId`](#parameter-privateendpointsroleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
 | [`description`](#parameter-privateendpointsroleassignmentsdescription) | string | The description of the role assignment. |
+| [`name`](#parameter-privateendpointsroleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
 | [`principalType`](#parameter-privateendpointsroleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
 
 ### Parameter: `privateEndpoints.roleAssignments.principalId`
@@ -1521,6 +1526,13 @@ The description of the role assignment.
 - Required: No
 - Type: string
 
+### Parameter: `privateEndpoints.roleAssignments.name`
+
+The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+
+- Required: No
+- Type: string
+
 ### Parameter: `privateEndpoints.roleAssignments.principalType`
 
 The principal type of the assigned principal ID.
@@ -1633,6 +1645,7 @@ Array of role assignments to create.
 | [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
 | [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
 | [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
+| [`name`](#parameter-roleassignmentsname) | string | The name (as GUID) of the role assignment. If not provided, a GUID will be generated. |
 | [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
 
 ### Parameter: `roleAssignments.principalId`
@@ -1683,6 +1696,13 @@ The description of the role assignment.
 - Required: No
 - Type: string
 
+### Parameter: `roleAssignments.name`
+
+The name (as GUID) of the role assignment. If not provided, a GUID will be generated.
+
+- Required: No
+- Type: string
+
 ### Parameter: `roleAssignments.principalType`
 
 The principal type of the assigned principal ID.

avm/res/container-registry/registry/main.bicep

@@ -189,6 +189,17 @@ var builtInRoleNames = {
  )
 }
 
+var formattedRoleAssignments = [
+ for (roleAssignment, index) in (roleAssignments ?? []): union(roleAssignment, {
+ roleDefinitionId: builtInRoleNames[?roleAssignment.roleDefinitionIdOrName] ?? (contains(
+ roleAssignment.roleDefinitionIdOrName,
+ '/providers/Microsoft.Authorization/roleDefinitions/'
+ )
+ ? roleAssignment.roleDefinitionIdOrName
+ : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName))
+ })
+]
+
 #disable-next-line no-deployments-resources
 resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
  name: '46d3xbcp.res.containerregistry-registry.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
@@ -417,14 +428,10 @@ resource registry_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021
 ]
 
 resource registry_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
- for (roleAssignment, index) in (roleAssignments ?? []): {
- name: guid(registry.id, roleAssignment.principalId, roleAssignment.roleDefinitionIdOrName)
+ for (roleAssignment, index) in (formattedRoleAssignments ?? []): {
+ name: roleAssignment.?name ?? guid(registry.id, roleAssignment.principalId, roleAssignment.roleDefinitionId)
  properties: {
- roleDefinitionId: contains(builtInRoleNames, roleAssignment.roleDefinitionIdOrName)
- ? builtInRoleNames[roleAssignment.roleDefinitionIdOrName]
- : contains(roleAssignment.roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/')
- ? roleAssignment.roleDefinitionIdOrName
- : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName)
+ roleDefinitionId: roleAssignment.roleDefinitionId
  principalId: roleAssignment.principalId
  description: roleAssignment.?description
  principalType: roleAssignment.?principalType
@@ -538,6 +545,9 @@ type lockType = {
 }?
 
 type roleAssignmentType = {
+ @description('Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated.')
+ name: string?
+
  @description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
  roleDefinitionIdOrName: string
 

avm/res/container-registry/registry/main.json

@@ -6,7 +6,7 @@
  "_generator": {
  "name": "bicep",
  "version": "0.29.47.4906",
- "templateHash": "3911914124035886468"
+ "templateHash": "7973084173813038260"
  },
  "name": "Azure Container Registries (ACR)",
  "description": "This module deploys an Azure Container Registry (ACR).",
@@ -66,6 +66,13 @@
  "items": {
  "type": "object",
  "properties": {
+ "name": {
+ "type": "string",
+ "nullable": true,
+ "metadata": {
+ "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+ }
+ },
  "roleDefinitionIdOrName": {
  "type": "string",
  "metadata": {
@@ -775,6 +782,13 @@
  }
  },
  "variables": {
+ "copy": [
+ {
+ "name": "formattedRoleAssignments",
+ "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+ "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+ }
+ ],
  "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
  "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
  "builtInRoleNames": {
@@ -938,20 +952,20 @@
  "registry_roleAssignments": {
  "copy": {
  "name": "registry_roleAssignments",
- "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+ "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
  },
  "type": "Microsoft.Authorization/roleAssignments",
  "apiVersion": "2022-04-01",
  "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
- "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+ "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
  "properties": {
- "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
- "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
- "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
- "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
- "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
- "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
- "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+ "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+ "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+ "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+ "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+ "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+ "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+ "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
  },
  "dependsOn": [
  "registry"

avm/res/container-registry/registry/tests/e2e/max/main.test.bicep

@@ -127,11 +127,13 @@ module testDeployment '../../../main.bicep' = [
  ]
  roleAssignments: [
  {
+ name: '60395919-cfd3-47bf-8349-775ddebb255e'
  roleDefinitionIdOrName: 'Owner'
  principalId: nestedDependencies.outputs.managedIdentityPrincipalId
  principalType: 'ServicePrincipal'
  }
  {
+ name: guid('Custom seed ${namePrefix}${serviceShort}')
  roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
  principalId: nestedDependencies.outputs.managedIdentityPrincipalId
  principalType: 'ServicePrincipal'

avm/res/container-registry/registry/version.json

@@ -1,6 +1,6 @@
 {
  "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
- "version": "0.3",
+ "version": "0.4",
  "pathFilters": [
  "./main.json"
  ]