Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to set scope field for role assignments #1092

Closed
SenthuranSivananthan opened this issue Dec 8, 2020 · 1 comment
Closed

Unable to set scope field for role assignments #1092

SenthuranSivananthan opened this issue Dec 8, 2020 · 1 comment

Comments

@SenthuranSivananthan
Copy link

Bicep version
Bicep CLI version 0.2.59 (5b0314c)

Describe the bug
I'm not able to assign roles to resources using Bicep. The use case is to assign Blob Data Contributor role to Azure Data Factory.

Error

Error BCP038: The property "scope" is not allowed on objects of type "Microsoft.Authorization/roleAssignments". Permissible properties include "dependsOn".

To Reproduce


param storageAccountPrefix string = 'stg'
param dataFactoryName string = 'adf'

var storageBlobDataContributorRoleId = 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'

resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' = {
  location: resourceGroup().location
  name: '${storageAccountPrefix}${uniqueString(resourceGroup().id)}'
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
  }
}

resource adf 'Microsoft.DataFactory/factories@2018-06-01' = {
  location: resourceGroup().location
  name: '${dataFactoryName}'
  identity: {
    type: 'SystemAssigned'
  }
}

resource adfToStgRoleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  name: guid(resourceGroup().id)
  **scope: stg.id**
  properties: {
    principalId: adf.identity.principalId
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', storageBlobDataContributorRoleId)
  }
}

Additional context
Scope is a valid attribute per ARM template reference: https://docs.microsoft.com/en-us/azure/templates/microsoft.authorization/roleassignments

@ghost ghost added the Needs: Triage 🔍 label Dec 8, 2020
@alex-frankel
Copy link
Collaborator

The work to enable this is tracked by #870. Going to close this since we are tracking it there.

@ghost ghost locked as resolved and limited conversation to collaborators May 29, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants