What Role Assignments Are Required For Bicep that assigns roles inside of Devops Pipeline?

Question

I have a bicep file (https://github.com/siegfried01/SimplerServiceBusSendReceiveDemo/blob/master/infrastructure/deploy-ServiceBusSimpleSendReceive.bicep#L365 ) that calls a bicep module (https://github.com/siegfried01/SimplerServiceBusSendReceiveDemo/blob/master/infrastructure/assignRbacRoleToFunctionApp.bicep#L16)

This works to create a service bus and function app where the function app can read the service bus queue.

However, when I try to execute this bicep file from inside a devops pipeline (https://github.com/siegfried01/SimplerServiceBusSendReceiveDemo/blob/master/azure-pipelines.yml#L116), I get this error:

ERROR: {

  "status": "Failed",

  "error": {

    "code": "DeploymentFailed",

    "target": "/subscriptions/acc26051-92a5-4ed1-a226-64a187bc27db/resourceGroups/rg_ServiceBusSimpleSendReceive/providers/Microsoft.Resources/deployments/ServiceBusSimpleSendReceive",

    "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",

    "details": [

      {

        "code": "InvalidTemplateDeployment",

        "message": "The template deployment failed with error: 'Authorization failed for template resource 'xxxxxxxxx' of type 'Microsoft.Authorization/roleAssignments'. The client 'xxxxxxx' with object id 'xxxx' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/xxxxxxb/resourceGroups/rg_ServiceBusSimpleSendReceive/providers/Microsoft.Authorization/roleAssignments/xxxxx'.'."

      }

    ]

  }

}

1. I assume I need to add 'Microsoft.Authorization/roleAssignments/write' to the service connection's service principal with the scope specified in the error message. Is this true?
2. I've tried to use the devops pipeline web GUI to modify the service connection. How do I do this? When I click on "managed service connection roles" it takes me to my subscription. Why? I (think I) want to add a "write" role to the service principal, not the subscription!
3. When I click on manage service principal it takes me to the service principal in azure AD. I click on "Roles and administrators" and there is no way add this 'write' role.
4. I think I would prefer to add 'Microsoft.Authorization/roleAssignments/write' with the azure CLI. How do I do that? Can I use the azure cli to create a new service principal with the scope of the resource group and the appropriatly assigned roles and use that for the service connection for my pipeline?

Thanks

Siegfried

Answer 1

Hi , Welcome to MS Q&A , you can perform below steps for your query

1. Identify the Service Principal: First, you need to identify the service principal used by your Azure DevOps pipeline. You can find this information in the Azure DevOps pipeline settings.
2. Assign Role: Once you have the service principal's details, you can use the Azure CLI to assign the required role. You can use the az role assignment create command to

      az role assignment create --role "Owner" --assignee <service_principal_id> --scope /subscriptions/xxxxxx/resourceGroups/rg_ServiceBusSimpleSendReceive
      
   

   Replace <service_principal_id> with the actual ID of your service principal.
3. Verify: After assigning the role, you can verify if the assignment was successful by checking the role assignments for the specified scope using the az role assignment list command.

By doing this, you're granting the necessary permission for the service principal to perform role assignments within the specified scope, resolving the error you encountered during the deployment.

Kindly check and accept , if it helps , Thanks!

Answer 2

For future readers (which might even include me some day!):

Since Deepanshu katara solved the problem but the actual solutions appears in the comments above and not the proposed solution, I'm designating this as the answer instead:

$appid=(az ad sp list --display-name "sheintze-devopsdemoproject001-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" --query "[0].appId" --output tsv)
write-output "appid=$appid"
az role assignment create --role "Owner" --assignee $appid --scope "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg_ServiceBusSimpleSendReceive"

Originally, I was using ".id" instead of ".appid" and that was not working.

sheintze-devopsdemoproject001-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx is the name of the service principal created by the devops pipeline web page when my colleague helped me create a new service connection in the devops web page.

Also, I had to run the pipeline multiple times before it started working with the above solution. Maybe there was a caching problem or something.

It seems that this is something the devops pipeline web page should do for you with the GUI. Perhaps it is broken?

Thank you Deepanshu katara

Siegfried