How to modularize a scoped role assignment with Bicep?

[WhitWaldo]

I need to scope a role assignment to a specific resource, but I'd ideally like to build out a generic module that I can use across my deployments for consistency. If I were assigning a role assignment at the subscription level, I could just do the following:

targetScope = 'subscription'

@description('The ID of the principal to receive the role assignment')
param principalId string
@description('The ID of the role definition to assign to the principal')
param roleDefinitionId string

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  name: guid(subscription().id, principalId, roleDefinitionId, 'abc123')
  properties: {
    principalId: principalId
    roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${roleDefinitionId}'
  }
}

But I'm running into an issue when I add a string parameter called 'scope' intending to pass it into the scope property on the resource. Namely, the Intellisense offered by Bicep indicates this needs to be either a resource or a tenant value and not a string.

I'm trying to scope to a resource and not to a tenant, so it seems I need to specify a resource, but the following isn't valid Bicep:

param resourceName string
param resourceScope string
param resourceVersion string

resource resource '${resourceScope}@${resourceVersion}' existing = {
  name: resourceName
}

Now, if I want to make this role assignment specific to one resource type, it's easy enough to solve:

targetScope = 'resourceGroup'

@description('The ID of the principal receiving the role assignment')
param principalId string
@description('The ID of the role definition to assign to the principal')
param roleDefinitionId string
@description('The name of the storage account to scope the role definition to')
param storageAccountName string

resource Storage 'Microsoft.Storage/storageAccounts@2021-06-01' existing = {
  name: storageAccountName
}

resource RoleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  name: guid(subscription().id, principalId, roleDefinitionId, 'abc123')
  scope: Storage
  properties: {
    principalId: principalId
    roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${roleDefinitionId}'
  }
}

But doing this now means that I need to create duplicate Bicep files for each and every type of resource I'm deploying now and in the future and that's not ideal.

Anyone have ideas on how to make this roleAssignment module generic to a passed-in resource type, version and name?

Thank you!

[brwilkinson]

Agree this would be ideal.

I don't think this is something that will come to be available in the near future.

• We are still waiting for some "work in progress" around passing Resources in as parameters and out as outputs, however there is no current plan for any generic resource types.

These are the proposals for work to be done to encapsulate this capability and this is not currently in scope here.
#2246
#2245

Also this PR is in progress.
#4971

• I would recommend to jump in and contribute on those issues/threads to ensure to communicate that this capability is in demand and why, since that is the body of work that would enable this capability. Like I say "Generic Resource Types" as parameters/outputs are not currently in scope.

• There is some work being done to allow these resources to be used on Parent/Scope properties of other resources, which should be part of that PR.

[brwilkinson]

More focused towards your actual request, here is the decompiled code... this is the reason why we cannot do this in Bicep currently.

param resourceName string

@allowed([
  'Microsoft.KeyVault/vaults'
])
param resourceType string
param name string
param roleDefinitionId string
param principalId string
param principalType string

resource name_resource 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = {
  scope: '${resourceType}/${resourceName}'
  name: name
  properties: {
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId)
    principalId: principalId
    principalType: principalType
  }
}

output roleAssignment string = extensionResourceId(resourceId('Microsoft.KeyVault/vaults', resourceName), 'Microsoft.Authorization/roleAssignments', name)

Which we are able to do in ARM/JSON

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "resourceName": {
      "type": "string"
    },
    "resourceType": {
      "type": "string",
      "allowedValues": [
        "Microsoft.KeyVault/vaults"
      ]
    },
    "name": {
      "type": "string"
    },
    "roleDefinitionId": {
      "type": "string"
    },
    "principalId": {
      "type": "string"
    },
    "principalType": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2020-08-01-preview",
      "scope": "[format('{0}/{1}',parameters('resourceType'),parameters('resourceName'))]",
      "name": "[parameters('name')]",
      "properties": {
        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))]",
        "principalId": "[parameters('principalId')]",
        "principalType": "[parameters('principalType')]"
      }
    }
  ],
  "outputs": {
    "roleAssignment": {
      "type": "string",
      "value": "[extensionResourceId(resourceId('Microsoft.KeyVault/vaults', parameters('resourceName')), 'Microsoft.Authorization/roleAssignments', parameters('name'))]"
    }
  }
}

[brwilkinson]

If you would like to implement this yourself here are the (complete and working) samples.

I have not finished integrating this into my other role assignment templates that I use, however you can easily take this and integrate it into your process. (I may make some updates as I do that integration).

This is the Bicep Module, which takes the string parameters for the role assignment, all simple stuff.

• it used json(loadtextcontent()) to read the nested json ARM template.

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.RBAC-ALL-RA-Resource.bicep

The nested ARM template:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/loadTextContext/genericRoleAssignment.json

Here is the nested decompiled Bicep version of that template, that is not supported in Bicep, which is your feature request.
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/loadTextContext/genericRoleAssignment.bicep

[WhitWaldo]

That's an awfully clever workaround to simply nest a JSON ARM template within the Bicep. Thank you!

[brwilkinson]

I made a v2 🤣

V2 can handle any segment length for the role assignment.

Here is the new version:

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.RBAC-ALL-RA-Resource.bicep
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/loadTextContext/genericRoleAssignment.json

I decided to bring the creation of the scope or resourceId back to Bicep. I couldn't think of an easier way to do this?!

param resourceName string = 'acu1brwaoap0sadiag/default/insights-logs-networksecuritygroupflowevent' //'acu1brwaoap0sadiag' // 'ACU1-BRW-AOA-G1-kvGlobal'
param resourceType string = 'Microsoft.Storage/storageAccounts/blobServices/containers'//'Microsoft.Storage/storageAccounts' //'Microsoft.KeyVault/vaults'
param name string = '15b85812-1b39-44de-a784-758d91b13fcc' //'2c363941-91d7-49d8-abb1-033b616bfc4b' // '561a1a73-3504-4162-abba-4563effd0159'
param roleDefinitionId string = '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' //'aba4ae5f-2193-4029-9191-0cb91df5e314' // '21090545-7ca7-4776-b22c-e363652d74d2'
param principalId string = '528b1170-7a6c-4970-94bb-0eb34e1ae947'
param principalType string = ''
#disable-next-line no-unused-params
param description string = '' // leave these for loggin in the portal
#disable-next-line no-unused-params
param roledescription string = '' // leave these for loggin in the portal

// ----------------------------------------------
// Implement own resourceId for any segment length
var segments = split(resourceType,'/')
var items = split(resourceName,'/')
var last = length(items)
var segment = [for (item, index) in range(1,last) : item == 1 ? '${segments[0]}/${segments[item]}/${items[index]}/' : item != last ? '${segments[item]}/${items[index]}/' : '${segments[item]}/${items[index]}' ]
var resourceid =  replace(replace(replace(string(string(segment)), '","', ''), '["', ''), '"]', '') // currently no join() method
// ----------------------------------------------

resource ResourceRoleAssignment 'Microsoft.Resources/deployments@2021-04-01' = {
    name: take(replace('dp-RRA-${resourceName}-${resourceType}', '/', ''),64)
    properties: {
        mode: 'Incremental'
        expressionEvaluationOptions: {
            scope: 'Outer'
        }
        template: json(loadTextContent('./loadTextContext/genericRoleAssignment2.json'))
        parameters: {
            scope: {
                value: resourceid
            }
            name: {
                value: name
            }
            roleDefinitionId: {
                value: roleDefinitionId
            }
            principalId: {
                value: principalId
            }
            principalType: {
                value: principalType
            }
        }
    }
}

output resourceid string = resourceid
output roleAssignmentId string = ResourceRoleAssignment.properties.outputs.roleAssignmentId.value

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "scope": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "roleDefinitionId": {
      "type": "string"
    },
    "principalId": {
      "type": "string"
    },
    "principalType": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2020-08-01-preview",
      "scope": "[parameters('scope')]",
      "name": "[parameters('name')]",
      "properties": {
        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))]",
        "principalId": "[parameters('principalId')]",
        "principalType": "[parameters('principalType')]"
      }
    }
  ],
  "outputs": {
    "roleAssignmentId": {
      "type": "string",
      "value": "[extensionResourceId(parameters('scope'), 'Microsoft.Authorization/roleAssignments', parameters('name'))]"
    }
  }
}

The inputs are:

param resourceName string = 'acu1brwaoap0sadiag/default/insights-logs-networksecuritygroupflowevent'
param resourceType string = 'Microsoft.Storage/storageAccounts/blobServices/containers'

The outputs are:

Outputs : 
Name Value
========== ==========
resourceId: "Microsoft.Storage/storageAccounts/acu1brwaoap0sadiag/blobServices/default/containers/insights-logs-networksecuritygroupflowevent"
roleAssignmentId: "/Microsoft.Storage/storageAccounts/acu1brwaoap0sadiag/blobServices/default/containers/insights-logs-networksecuritygroupflowevent/providers/Microsoft.Authorization/roleAssignments/15b85812-1b39-44de-a784-758d91b13fcc"

[brwilkinson]

That's an awfully clever workaround to simply nest a JSON ARM template within the Bicep. Thank you!

I had this on my mind for a while, thank you for the nudge to work on it.

[brwilkinson]

In looking at this more, it would be nice if there was a scope() function, that takes strings as arguments.

• Basically an extension of resourceId()
  • At least as a workaround for this.
  • Ideally then we can pass Scope instead of passing a Resource.

[brwilkinson]

Added comment on open proposal discussion.

#2245 (comment)

[matsest]

@WhitWaldo Another suggestion here using a top-level bicep template with Bicep/ARM as child modules: https://github.com/matsest/az-bicep-roleassignment-multi-scope

Still a very much workaround solution, and blocked by the same issue listed by @brwilkinson to be Bicep only