Azure Bicep - 不同订阅中的角色分配

Question

尝试将托管标识分配给同一租户中单独订阅中的资源组。我可以通过 Azure 门户实现此目的。我的 Main.bicep，类似这样:

targetScope = 'subscription'

module rgRoleAssignment 'modules/MyModule.bicep' = {
  scope: resourceGroup('anotherSubscriptionId', 'myResourceGroupName')
  name: 'qwerty123'
  params: {
    principalId: MyManagedIdentity.outputs.principalId
    roleDefinitionIds: ['7f951dda-4ed3-4680-a7ca-43fe172d538d'] //ACRPull
  }
}

MyModule.bicep:

targetScope = 'resourceGroup'

param roleDefinitionIds array
param roleAssignmentDescription string = ''
param principalId string 

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = [for roleDefinitionId in roleDefinitionIds: {
    name: guid(roleDefinitionId, resourceGroup().id)
    scope: resourceGroup()
    properties: {
        description: roleAssignmentDescription
        principalId: principalId
        roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId)
        principalType: 'ServicePrincipal'
    }
}]

这会返回可怕的“租户 ID、应用程序 ID、主体 ID 和范围不允许更新。(代码:RoleAssignmentUpdateNotPermission)”错误，这通常意味着该位置存在孤立的角色分配，但我可以'没有看到任何。我错过了什么？

Answer 1

"Tenant ID, application ID, principal ID, and scope are not allowed to be updated. (Code: RoleAssignmentUpdateNotPermitted)" error: -

在大多数情况下，此错误的原因可能是名称冲突。将角色分配的名称(只不过是 GUID)更改为之前未用于部署角色分配的值。

引用blog作者:@Jason Masten & github问题以获取相关信息。

Verify the scope of the uniqueness of your resource names. Use appropriate seed values for the uniqueString() function to ensure that you can reuse the Bicep file across Azure resource groups and subscriptions as given in MSDoc.

检查完上述内容后，我尝试将其部署到我的环境中并进行上述更改，并且能够成功部署，如图所示。

模块.bicep:

targetScope = 'subscription'
param location string = resourceGroup().location
module rgRoleAssignment 'iden.bicep' = {
  scope: resourceGroup('subscription_ID','resourceGroup')
  name: 'qwerty123'
  params: {
    principalId: useridentiy.properties.principalId
    roleDefinitionIds: ['7f951dda-4ed3-4680-a7ca-43fe172d538d']
  }
}

Identity.bicep:

targetScope = 'resourceGroup'
param roleDefinitionIds array
param roleAssignmentDescription string = ''
param principalId string 

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = [for roleDefinitionId in roleDefinitionIds: {
    name: guid(resourceGroup().id, principalId, roleDefinitionId)
    scope: resourceGroup()
    properties: {
        description: roleAssignmentDescription
        principalId: principalId
        roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId)
        principalType: 'ServicePrincipal'
    }
}]

部署成功:

您也可以引用SO @Richard 提出类似问题。