roleAssignment to any resource in any resource group

[yuanyi2121]

I'm trying to write a module that can do role assignment for many given resourcce/sp. I came across this solution: https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.RBAC-ALL-RA-Resource.bicep, it was pretty close but I don't like the idea of having to embed a json arm template inside bicep.
I think the problem here is that the roleAssignment in bicep is too restrictive - to define a roleAssignment to a specific resource, you need a scope. The scope only takes either a resource or a tenant. To define a resource, you have to do something like this
resource keyVault 'Microsoft.KeyVault/vaults@2019-09-01' = ...
but
var resourceType = 'Microsoft.KeyVault/vaults@2019-09-01'
resource keyVault resourceType = ...
won't work. Is there a way to define a resource from a variable/parameter, or define a resource from a resourceId? Or even better, can scope take a resourceId instead?

[brwilkinson]

There is currently a preview feature outlined as below.

You enable this feature in the bicepconfig.json file.

{
  "experimentalFeaturesEnabled": {
    "resourceTypedParamsAndOutputs": true
  }
}

More info here:

• Proposal - simplifying resource referencing (part 1) #2245
• Proposal - simplifying resource referencing (part 2) #2246

I believe it may be possible to enable to use a resource parameter for the scope of a role assignment based on this feature and passing a resource? I haven't tested it out, however I can try to follow up on this one.

There may also be another issue open to create a scope from a ResourceId, if I can find it I will link it later.

In the mean time using the static JSON file that you mentioned, via the following Bicep works well.

• https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.RBAC-ALL.bicep
• https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.RBAC-ALL-RA-Resource.bicep
• https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/loadTextContext/genericRoleAssignment.json

You shouldn't have to touch the Json file at all. Plus you can just call into the Module x.RBAC-ALL.bicep easily from any other Module.

Example of different templates that do Resource Scope Role assignments.

This is how you consume the Module....

• https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/KV-KeyVault.bicep#LL171-L182C3

var rolesInfo = contains(KVInfo, 'rolesInfo') ? KVInfo.rolesInfo : []

module RBAC 'x.RBAC-ALL.bicep' = [for (role, index) in rolesInfo: {
  name: take(replace('dp-rbac-role-${KV.name}-${role.name}', '@', '_'), 64)
  params: {
    resourceId: KV.id
    Global: Global
    roleInfo: role
    Type: contains(role, 'Type') ? role.Type : 'lookup'
    deployment: Deployment
  }
}]

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/SA-Storage.bicep#LL89-L100C3

var rolesInfo = contains(storageInfo, 'rolesInfo') ? storageInfo.rolesInfo : []

module RBAC 'x.RBAC-ALL.bicep' = [for (role, index) in rolesInfo: {
    name: 'dp-rbac-role-${storageInfo.name}-${role.name}'
    params: {
        resourceId: SA.id
        Global: Global
        roleInfo: role
        Type: contains(role,'Type') ? role.Type : 'lookup'
        deployment: Deployment
    }
}]

Example of rolesInfo on a Keyvault:

• https://github.com/brwilkinson/AzureDeploymentFramework/blob/c995521c275b77ddf3b3aa94024453d75267c8d3/ADF/tenants/HUB/ACU1.P0.parameters.json#L375

[yuanyi2121]

Thanks, Ben. The preview feature looks promising. (But it surprises me that the feature has been proposed for 2 years but still in preview?)

The workaround you mentioned in the second half does work. I'm using it in my project. I just don't feel it is a perfect solution as the existence of x.RBAC-ALL-RA-Resource.bicep is just to passing parameters to the actual template (which is in ARM, not bicep). I hope to merge these two into one bicep file someday.

[brwilkinson]

Yeah the team are working on the feature... 😊

The reason why I didn't combine them, it's simply because the json can be opened using the ARM extension, so you get linting on the ARM json.

If you want to combine it, it's easy to do..

Just use the following syntax.

template: json(loadTextContent('./loadTextContext/genericRoleAssignment.json'))

template: '''
paste the code from the json file here
'''

The three ''' allows for multi line string.

[yuanyi2121]

Thanks for the ''' tip. Didn't know that before.