Role Assignment conflicts when assignment is scoped to BLOB container level. #11429

dermot-cochran-ul · 2023-07-26T08:17:19Z

dermot-cochran-ul
Jul 26, 2023

Bicep version
run bicep --version via the Bicep CLI, az bicep version via the AZ CLI or via VS code by navigating to the extensions tab and searching for Bicep

Bicep CLI version 0.19.5 (87ca110)

Describe the bug
A clear and concise description of what the bug is vs what you expected to happen

We have several BLOB Storage Accounts with several different containers. We want to control access at the container level so that each container has a specific group of users.

To Reproduce
Steps to reproduce the behavior:

Assuming that the storage accounts and containers already exist:

resource storageContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2022-09-01' existing = {
  name: 'storageAccountName/default/projectName'
}

resource contributorRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for principalId in roleMembership.contributors: {
  name: guid(principalId, contributorRoleId, storageContainer.id)
  scope: storageContainer
  properties: {
    roleDefinitionId: contributorRoleId
    principalId: principalId
    principalType: 'User'
  }
}]

This is repeated for multiple different storage accounts, containers and roles.

Additional context
Add any other context about the problem here.

Here is a sample of the Bicep debug log with the "Role assignment already exists" conflict error.

2023-07-26T07:58:01.8617085Z ==============================================================================
2023-07-26T07:58:01.8617453Z Task : Azure CLI
2023-07-26T07:58:01.8617624Z Description : Run Azure CLI commands against an Azure subscription in a PowerShell Core/Shell script when running on Linux agent or PowerShell/PowerShell Core/Batch script when running on Windows agent.
2023-07-26T07:58:01.8617938Z Version : 2.225.0
2023-07-26T07:58:01.8618094Z Author : Microsoft Corporation
2023-07-26T07:58:01.8618232Z Help : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/azure-cli
2023-07-26T07:58:01.8618428Z ==============================================================================
2023-07-26T07:58:03.1421636Z [command]/usr/bin/az --version
2023-07-26T07:58:04.9549558Z azure-cli 2.50.0
2023-07-26T07:58:04.9550443Z
2023-07-26T07:58:04.9551127Z core 2.50.0
2023-07-26T07:58:04.9551525Z telemetry 1.0.8
2023-07-26T07:58:04.9551795Z
2023-07-26T07:58:04.9552035Z Extensions:
2023-07-26T07:58:04.9552370Z azure-devops 0.26.0
2023-07-26T07:58:04.9552530Z
2023-07-26T07:58:04.9552760Z Dependencies:
2023-07-26T07:58:04.9553014Z msal 1.22.0
2023-07-26T07:58:04.9553347Z azure-mgmt-resource 23.1.0b2
2023-07-26T07:58:04.9553516Z
2023-07-26T07:58:04.9553834Z Python location '/opt/az/bin/python3'
2023-07-26T07:58:04.9554208Z Extensions directory '/opt/az/azcliextensions'
2023-07-26T07:58:04.9554385Z
2023-07-26T07:58:04.9554718Z Python (Linux) 3.10.10 (main, Jun 29 2023, 11:09:14) [GCC 11.3.0]
2023-07-26T07:58:04.9554973Z
2023-07-26T07:58:04.9555267Z Legal docs and information: aka.ms/AzureCliLegal
2023-07-26T07:58:04.9555462Z
2023-07-26T07:58:04.9555600Z
2023-07-26T07:58:04.9555915Z Your CLI is up-to-date.
2023-07-26T07:58:04.9605153Z Setting AZURE_CONFIG_DIR env variable to: /home/vsts/work/_temp/.azclitask
2023-07-26T07:58:04.9623418Z Setting active cloud to: AzureCloud
2023-07-26T07:58:04.9666515Z [command]/usr/bin/az cloud set -n AzureCloud

2023-07-26T07:58:14.1346525Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
2023-07-26T07:58:14.1357512Z DEBUG: cli.azure.cli.core: Modules found from index for 'deployment': ['azure.cli.command_modules.resource']
2023-07-26T07:58:14.1358427Z DEBUG: cli.azure.cli.core: Loading command modules:
2023-07-26T07:58:14.1359021Z DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
2023-07-26T07:58:14.1526312Z DEBUG: cli.azure.cli.core: resource 0.017 51 224
2023-07-26T07:58:14.1527747Z DEBUG: cli.azure.cli.core: Total (1) 0.017 51 224
2023-07-26T07:58:14.1534867Z DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
2023-07-26T07:58:14.1536054Z DEBUG: cli.azure.cli.core: Loading extensions:
2023-07-26T07:58:14.1539937Z DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
2023-07-26T07:58:14.1540621Z DEBUG: cli.azure.cli.core: Total (0) 0.000 0 0
2023-07-26T07:58:14.1541436Z DEBUG: cli.azure.cli.core: Loaded 51 groups, 224 commands.
2023-07-26T07:58:14.1545296Z DEBUG: cli.azure.cli.core: Found a match in the command table.
2023-07-26T07:58:14.1546006Z DEBUG: cli.azure.cli.core: Raw command : deployment group create
2023-07-26T07:58:14.1550215Z DEBUG: cli.azure.cli.core: Command table: deployment group create
2023-07-26T07:58:14.1550881Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f412d51ad40>]
2023-07-26T07:58:14.1553403Z DEBUG: cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/vsts/work/_temp/.azclitask/commands/2023-07-26.07-58-14.deployment_group_create.1794.log'.
2023-07-26T07:58:14.1554682Z INFO: az_command_data_logger: command args: deployment group create --debug --name {} --resource-group {} --template-file {} --parameters {} {}
2023-07-26T07:58:14.1555645Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f412d53b880>]
2023-07-26T07:58:14.7525435Z DEBUG: cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
2023-07-26T07:58:14.7527454Z File "/opt/az/lib/python3.10/site-packages/azure/cli/core/profiles/_shared.py", line 659, in _get_attr
2023-07-26T07:58:14.7528335Z op = getattr(op, part)
2023-07-26T07:58:14.7529460Z AttributeError: module 'azure.mgmt.resource.resources.v2022_09_01.models' has no attribute 'ExemptionCategory'
2023-07-26T07:58:14.7530095Z
2023-07-26T07:58:14.7563175Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
2023-07-26T07:58:14.7564261Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f412d57d7e0>, <function register_cache_arguments..add_cache_arguments at 0x7f412d57d900>]
2023-07-26T07:58:14.7597776Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
2023-07-26T07:58:14.7598714Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
2023-07-26T07:58:14.7611639Z DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f412e4bc310>, <function CLIQuery.handle_query_parameter at 0x7f412e4e5510>, <function register_ids_argument..parse_ids_arguments at 0x7f412d57d870>]
2023-07-26T07:58:14.7619368Z DEBUG: cli.azure.cli.command_modules.resource._bicep: Current value of "use_binary_from_path": if_found_in_ci.
2023-07-26T07:58:14.7624671Z DEBUG: cli.azure.cli.command_modules.resource._bicep: Running in a CI environment. Bicep CLI available on PATH: True.
2023-07-26T07:58:15.2378766Z DEBUG: cli.azure.cli.command_modules.resource._bicep: Using Bicep CLI from PATH. Bicep CLI version 0.19.5 (87ca110)
2023-07-26T07:58:15.2379722Z
2023-07-26T07:58:20.8524937Z DEBUG: cli.azure.cli.core.util: invalid syntax (, line 1)
2023-07-26T07:58:20.8664700Z DEBUG: cli.azure.cli.core.util: invalid syntax (, line 1)
2023-07-26T07:58:20.8671748Z DEBUG: cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient
2023-07-26T07:58:20.8778109Z DEBUG: cli.azure.cli.core.auth.persistence: build_persistence: location='/home/vsts/work/_temp/.azclitask/service_principal_entries.json', encrypt=False
2023-07-26T07:58:20.8784833Z DEBUG: cli.azure.cli.core.auth.persistence: build_persistence: location='/home/vsts/work/_temp/.azclitask/msal_token_cache.json', encrypt=False
2023-07-26T07:58:20.8785997Z DEBUG: cli.azure.cli.core.auth.binary_cache: load: /home/vsts/work/_temp/.azclitask/msal_http_cache.bin
2023-07-26T07:58:20.8792281Z DEBUG: urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
2023-07-26T07:58:20.8801388Z DEBUG: msal.authority: openid_config = {'token_endpoint': 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/70115954-0ccd-45f0-87bd-03b2a3587569/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/70115954-0ccd-45f0-87bd-03b2a3587569/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/70115954-0ccd-45f0-87bd-03b2a3587569/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/70115954-0ccd-45f0-87bd-03b2a3587569/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/ 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
2023-07-26T07:58:20.8804154Z DEBUG: msal.application: Broker enabled? False
2023-07-26T07:58:20.8805022Z DEBUG: msal.application: Region to be used: None
2023-07-26T07:58:20.8892363Z DEBUG: cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
2023-07-26T07:58:20.8893217Z DEBUG: cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
2023-07-26T07:58:20.8898093Z DEBUG: msal.application: Cache hit an AT
2023-07-26T07:58:20.8908287Z DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'POST'
2023-07-26T07:58:20.8908752Z DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
2023-07-26T07:58:20.8909282Z DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
2023-07-26T07:58:20.8909826Z DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '524660'
2023-07-26T07:58:20.8910365Z DEBUG: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
2023-07-26T07:58:20.8910987Z DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '2c156861-2b8a-11ee-9d41-13531cdfad6e'
2023-07-26T07:58:20.8911584Z DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment group create'
2023-07-26T07:58:20.8912220Z DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--debug --name --resource-group --template-file --parameters'
2023-07-26T07:58:20.8913118Z DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.50.0 (DEB) azsdk-python-azure-mgmt-resource/23.1.0b2 Python/3.10.10 (Linux-5.15.0-1041-azure-x86_64-with-glibc2.35) VSTS_6cab107a-8912-4e39-80e8-10da2f8595af_build_463_0'

2023-07-26T07:59:23.3962846Z DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last):
2023-07-26T07:59:23.3964889Z File "/opt/az/lib/python3.10/site-packages/azure/core/polling/base_polling.py", line 517, in run
2023-07-26T07:59:23.3965702Z self._poll()
2023-07-26T07:59:23.3966386Z File "/opt/az/lib/python3.10/site-packages/azure/core/polling/base_polling.py", line 557, in _poll
2023-07-26T07:59:23.3966959Z raise OperationFailed("Operation failed or canceled")
2023-07-26T07:59:23.3967491Z azure.core.polling.base_polling.OperationFailed: Operation failed or canceled
2023-07-26T07:59:23.3967874Z
2023-07-26T07:59:23.3968324Z During handling of the above exception, another exception occurred:
2023-07-26T07:59:23.3968664Z
2023-07-26T07:59:23.3969071Z Traceback (most recent call last):
2023-07-26T07:59:23.3969748Z File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 708, in _run_job
2023-07-26T07:59:23.3971686Z result = LongRunningOperation(cmd_copy.cli_ctx, 'Starting {}'.format(cmd_copy.name))(result)
2023-07-26T07:59:23.3972464Z File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 1013, in call
2023-07-26T07:59:23.3973004Z raise exception
2023-07-26T07:59:23.3973669Z File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 1000, in call
2023-07-26T07:59:23.3974225Z result = poller.result()
2023-07-26T07:59:23.3974876Z File "/opt/az/lib/python3.10/site-packages/azure/core/polling/_poller.py", line 255, in result
2023-07-26T07:59:23.3975377Z self.wait(timeout)
2023-07-26T07:59:23.3976062Z File "/opt/az/lib/python3.10/site-packages/azure/core/tracing/decorator.py", line 78, in wrapper_use_tracer
2023-07-26T07:59:23.3976614Z return func(*args, **kwargs)
2023-07-26T07:59:23.3977267Z File "/opt/az/lib/python3.10/site-packages/azure/core/polling/_poller.py", line 275, in wait
2023-07-26T07:59:23.3977818Z raise self._exception # type: ignore
2023-07-26T07:59:23.3978567Z File "/opt/az/lib/python3.10/site-packages/azure/core/polling/_poller.py", line 192, in _start
2023-07-26T07:59:23.3979114Z self._polling_method.run()
2023-07-26T07:59:23.3979768Z File "/opt/az/lib/python3.10/site-packages/azure/core/polling/base_polling.py", line 535, in run
2023-07-26T07:59:23.3980300Z raise HttpResponseError(
2023-07-26T07:59:23.3981209Z azure.core.exceptions.HttpResponseError: (DeploymentFailed) At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.
2023-07-26T07:59:23.3981893Z Code: DeploymentFailed
2023-07-26T07:59:23.3982706Z Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.

2023-07-26T07:59:23.3984689Z Exception Details: (ResourceDeploymentFailure) The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.
2023-07-26T07:59:23.3985282Z Code: ResourceDeploymentFailure
2023-07-26T07:59:23.3985986Z Message: The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.

2023-07-26T07:59:23.3988999Z Exception Details: (DeploymentFailed) At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.
2023-07-26T07:59:23.3989657Z Code: DeploymentFailed
2023-07-26T07:59:23.3990449Z Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.

2023-07-26T07:59:23.3992463Z Exception Details: (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3993034Z Code: RoleAssignmentExists
2023-07-26T07:59:23.3993565Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3994253Z Code: RoleAssignmentExists
2023-07-26T07:59:23.3994745Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3995249Z Code: RoleAssignmentExists
2023-07-26T07:59:23.3995750Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3996620Z Code: RoleAssignmentExists
2023-07-26T07:59:23.3997138Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3997651Z Code: RoleAssignmentExists
2023-07-26T07:59:23.3998159Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3998676Z Code: RoleAssignmentExists
2023-07-26T07:59:23.3999187Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.3999687Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4000183Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4000682Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4001380Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4001881Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4002410Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4002934Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4003451Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4003978Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4004651Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4005191Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4007113Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4008954Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4009768Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4015030Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4015781Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4016320Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4016837Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4017322Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4020749Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4021491Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4022041Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4022570Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4023106Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4023624Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4024310Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4030688Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4031650Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4032207Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4032758Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4033285Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4033865Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4034544Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4035226Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4040594Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4042123Z Message: The role assignment already exists. (ResourceDeploymentFailure) The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.
2023-07-26T07:59:23.4043289Z Code: ResourceDeploymentFailure

2023-07-26T07:59:23.4065580Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4066126Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4066659Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4067199Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4068305Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4069227Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4069904Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4070447Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4070970Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4071485Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4072004Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4073012Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4073546Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4074062Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4074577Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4075093Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4093445Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4094486Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4094997Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4095585Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4096028Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4096473Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4096928Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4097366Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4097805Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4098239Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4098674Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4099176Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4100071Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4100515Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4100931Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4101371Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4101812Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4102244Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4102734Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4103173Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4103604Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4104065Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4104506Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4104935Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4105364Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4105791Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4106230Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4106634Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4107064Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4107738Z Message: The role assignment already exists. (RoleAssignmentExists) The role assignment already exists.
2023-07-26T07:59:23.4108272Z Code: RoleAssignmentExists
2023-07-26T07:59:23.4109265Z Message: The role assignment already exists. (ResourceDeploymentFailure) The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.
2023-07-26T07:59:23.4109844Z Code: ResourceDeploymentFailure

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/arm.py", line 109, in handle_template_based_exception
raise CLIError(ex.inner_exception.error.message)
AttributeError: 'OperationFailed' object has no attribute 'error'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 663, in execute
raise ex
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 718, in _run_job
return cmd_copy.exception_handler(ex)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/arm.py", line 112, in handle_template_based_exception
raise_subdivision_deployment_error(ex.response.internal_response.text, ex.error.code if ex.error else None)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/arm.py", line 104, in raise_subdivision_deployment_error
raise DeploymentError(error_message)
DEBUG: cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f412d51af80>]
INFO: az_command_data_logger: exit code: 1
INFO: cli.main: Command ran in 69.545 seconds (init: 0.254, invoke: 69.292)
INFO: telemetry.main: Begin splitting cli events and extra events, total events: 1
INFO: telemetry.client: Accumulated 0 events. Flush the clients.
INFO: telemetry.main: Finish splitting cli events and extra events, cli events: 1
INFO: telemetry.save: Save telemetry record of length 29857 in cache
WARNING: telemetry.check: Negative: The /home/vsts/work/_temp/.azclitask/telemetry.txt was modified at 2023-07-26 07:58:09.092016, which in less than 600.000000 s
##[error]Script failed with exit code: 1

alex-frankel · 2023-07-26T14:15:48Z

alex-frankel
Jul 26, 2023
Maintainer

It is not possible to create two role assignments with the same GUID today - it has to be unique within the tenant. This is not a bicep restriction FWIW.

You have a few options:

find the role assignment with that GUID and delete it. To get the guid, you might want to create a dummy deployment that does not actually create the role assignment, but just calculates the GUID and outputs it so you know what to search (i.e. output roleGuid string = guid(principalId, contributorRoleId, storageContainer.id))
Come up with a way to make the GUID more unique by adding more unique arguments to the GUID function.

3 replies

lorenzo-biava Aug 4, 2023

@alex-frankel what if you do not control all of the other roles created by other teams in the same tenant, albeit under different subscriptions? You will always be at risk of clashing with existing GUIDs, no matter how many things you add to the formula, as other teams/deployments might use whatever algorithm they want to generate theirs.

At this point the only way would be to add some sort of override and use it only on the instances that happen to have that collision, because if you change the entire formula, and then you get a new collision, you'll always be in trouble (not to mention, existing role assignments will change GUID and will need to be manually removed before letting ARM/Bicep recreate them).

Am I missing something here? Will Deployment Stacks provide a better way to handle this?

alex-frankel Aug 4, 2023
Maintainer

Your understanding is correct. A naming collision will always be possible, just very unlikely assuming the GUID calculation is complex enough. In theory, we could build some exception handling such that if you get a conflict, you could try another name, but that is not something that we have committed to.

This problem also holds for any other resources with strong naming restrictions - for example, storage account names must be globally unique across tenants. You could run into the same problem there as well.

Deployment Stacks does not do anything to address this.

lorenzo-biava Aug 4, 2023

Well for "free text" names you do have more flexibility, like adding some sort of prefix hopefully unique to your team, and they are a bit more predictable on the human factor. But true, there is still a risk.

We'll just reuse the same strategy of allowing overrides for now.
Perhaps not the most elegant solution, but maybe it can be helpful for others as option # 3 (only override collisions).

param rbacGuidOverrides object = {
  '54f1ec3c-790d-5f39-bbbb-e5633984c29f': 'ea8a3894-ece8-42d6-bbbb-c29007b71334'
}

var allRoleAssignmentsBundle = [for principalId in <something>: {
  nameGuid: guid(subscription().id, principalId, PEPRoleID)
  principalId: principalId
  roleDefinitionId: PEPRoleID
}]

resource allRoleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for roleData in allRoleAssignmentsBundle: {
  // This allows ad hoc overrides in case there are any collisions
  // Unfortunately, this GUID is just a static hash function and it must be unique
  // across the AAD tenant, where other teams might be generating any sort of GUIDs!
  // It's just meant to be an emergency toggle for edge cases.
  name: rbacGuidOverrides[?roleData.nameGuid] ?? roleData.nameGuid
  properties: {
    principalId: roleData.principalId 
    roleDefinitionId: roleData.roleDefinitionId
   }
}]

dermot-cochran-ul · 2023-07-26T15:48:02Z

dermot-cochran-ul
Jul 26, 2023
Author

All of the GUIDs should be unique since the combination of principalId, roleId and storageContainer.id is unique.

0 replies

alex-frankel · 2023-07-27T19:38:46Z

alex-frankel
Jul 27, 2023
Maintainer

It may be the case that they should be unique, but for whatever reason, they are not. The options above are still the only options for moving forward. If you can find the conflicting pre-existing role assignment, you may be able to figure out why that other one was created with the same GUID as what you are deploying via Bicep.

0 replies

dermot-cochran-ul · 2023-07-28T07:27:59Z

dermot-cochran-ul
Jul 28, 2023
Author

That's fine as a workaround. Should I leave this as an open issue or should it be closed for now?

2 replies

dermot-cochran-ul Aug 1, 2023
Author

It seems that the role assignments are being created successfully despite the errors and warnings.

brwilkinson Aug 7, 2023
Maintainer

@dermot-cochran-ul
are you certain the role assignments didn't exist before? Perhaps they were created with a different guid initially.

I would delete one of them, then re-deploy and watch it come back, without any error. Then if that is the case delete the rest and redeploy to ensure they all have the deterministic guid, that comes from your bicep template.

alex-frankel · 2023-07-31T22:17:33Z

alex-frankel
Jul 31, 2023
Maintainer

I will move it to a Discussion for now where it can continue to collect feedback. Feel free to update with additional details as you reach a maintainable solution.

0 replies

dermot-cochran-ul · 2023-12-01T10:17:19Z

dermot-cochran-ul
Dec 1, 2023
Author

This is working fine now. I am not sure what changed, but I am no longer seeing these warnings.

0 replies

CodyBatt · 2024-08-06T15:41:15Z

CodyBatt
Aug 6, 2024

This issue is one of the worst problems to debug in azure. It would be very nice if role assignment conflict error messages could be augmented with some useful information. Instead of just the GUID of the role assignment, include the principal, role name and resource ids to make this trivial to debug. As it is this is one of the worst problems to hit in a bicep file because it's extremely difficult when you have a lot of role assignments to figure out what's wrong.

0 replies

jenchiers · 2024-08-20T14:21:23Z

jenchiers
Aug 20, 2024

I've been puzzled about this this afternoon. I get the error that is being described here, but the GUID that it says already exists, does not exist.

That's the GUI it generated, and if I query all GUIDs in my subscription it's not listed:

If I change the unique string seed the deployment succeeds and I see the GUID it generated and the GUID that is assigned. It's like the first GUID exists, but I can't see it?

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Role Assignment conflicts when assignment is scoped to BLOB container level. #11429

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 8 comments 5 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Role Assignment conflicts when assignment is scoped to BLOB container level. #11429

dermot-cochran-ul Jul 26, 2023

Replies: 8 comments · 5 replies

alex-frankel Jul 26, 2023 Maintainer

lorenzo-biava Aug 4, 2023

alex-frankel Aug 4, 2023 Maintainer

lorenzo-biava Aug 4, 2023

dermot-cochran-ul Jul 26, 2023 Author

alex-frankel Jul 27, 2023 Maintainer

dermot-cochran-ul Jul 28, 2023 Author

dermot-cochran-ul Aug 1, 2023 Author

brwilkinson Aug 7, 2023 Maintainer

alex-frankel Jul 31, 2023 Maintainer

dermot-cochran-ul Dec 1, 2023 Author

CodyBatt Aug 6, 2024

jenchiers Aug 20, 2024

dermot-cochran-ul
Jul 26, 2023

Replies: 8 comments 5 replies

alex-frankel
Jul 26, 2023
Maintainer

alex-frankel Aug 4, 2023
Maintainer

dermot-cochran-ul
Jul 26, 2023
Author

alex-frankel
Jul 27, 2023
Maintainer

dermot-cochran-ul
Jul 28, 2023
Author

dermot-cochran-ul Aug 1, 2023
Author

brwilkinson Aug 7, 2023
Maintainer

alex-frankel
Jul 31, 2023
Maintainer

dermot-cochran-ul
Dec 1, 2023
Author

CodyBatt
Aug 6, 2024

jenchiers
Aug 20, 2024