azure - 尝试修改存储帐户的角色分配时出现 Bicep 错误

Question

我是二头肌新手。我需要为几个用户提供存储帐户的角色。

所以我写了一个模块，但它给了我一个错误。

Status Message: The role definition ID| 'Storage Blob Data Contributor' is not valid. (Code:InvalidRoleDefinitionId) Status Message: The role definition ID 'Storage Blob| Data Contributor' is not valid. (Code:InvalidRoleDefinitionId) Status Message: At least one resource deployment operation failed.| Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code:| DeploymentFailed) - { "error": { "code": "InvalidRoleDefinitionId", "message": "The role definition ID 'Storage Blob| Data Contributor' is not valid." } } (Code:BadRequest) - { "error": { "code": "InvalidRoleDefinitionId", "message":| "The role definition ID 'Storage Blob Data Contributor' is not valid." } } (Code:BadRequest)

这是模块代码:

param roleDefinitionResourceName string = 'Storage Blob Data Contributor'
param storageAccountName string = 'mysa'

resource sa 'Microsoft.Storage/storageAccounts@2021-09-01' existing = {
  name: storageAccountName
}

resource role 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
  name: roleDefinitionResourceName
}

var roleDefinitionResourceId = role.id // here I collect the role ID

var syIdentity = synapse_workspace.identity //Synapse Managed Identity object ID
var principalId = syIdentity.principalId

resource roleAssignmentsy 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  scope: sa
  name: guid(sa.id, synapse_workspace.name, roleDefinitionResourceName)
  properties: {
    roleDefinitionId: roleDefinitionResourceId
    principalId: principalId
    principalType: 'ServicePrincipal'
  }
}

principalId 是突触工作区的托管标识，但我使用用户帐户得到相同的结果。

有什么建议吗？

Answer 1

您需要使用 roleDefinitionName 的 GUID，遗憾的是您无法使用描述。所以必须是:

param roleDefinitionResourceName string = 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'

目前还没有办法从友好名称转到resourceId 所需的GUID。