user defined types for role assignment

[pattisanta]

I tried using user defined type role assignment.
here is the error message
got error: InvalidTemplate - Deployment template validation failed: 'The resource 'Microsoft.Authorization/roleDefinitions/b7e6dc6d-f1e8-4753-8033-0f276bb0955b' at line '1' and column '2630' is defined multiple times in a template

---

here is an example of the

@export()
@description('Custom type for assignment of a particular role to a particular principal')
type roleAssignmentType = {
  @description('ObjectID of the user, service principal, or group being assigned the role')
  principalId: string
  @description('ObjectID of the role being assigned')
  roleDefinitionId: string
}

---

import {roleAssignmentType} from 'br:crshrdtfa01.azurecr.io/bicep/modules/type/type-roleassignment:1-latest'

@description('The name of your virtual machine')
param vmName string

@description('Assigning rbac roles a azure resource.')
@metadata({
  principalId: 'User or group objectId'
  roleDefinitionId: 'Azure role objectId'
})
param roleAssignments roleAssignmentType[]
resource vm 'Microsoft.Compute/virtualMachines@2021-03-01' existing=  {
  name: vmName
}

resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = [for i in range(0, length(roleAssignments)): {
  name: roleAssignments[i].roleDefinitionId
}]

var roleAssignGuid = [for i in range(0, length(roleAssignments)): guid(subscription().id, resourceGroup().id, vmName, roleAssignments[i].principalId, roleDef[i].id)]

resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for i in range(0, length(roleAssignments)): {
  name: roleAssignGuid[i]
  scope: vm
  properties: {
    principalId: roleAssignments[i].principalId
    roleDefinitionId: roleDef[i].id
  }
}]

this bicep file being called as a module in another bicep file.

Thanks in advance for your help,
Patti

[GABRIELNGBTUC]

The error is pretty clear:

resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = [for i in range(0, length(roleAssignments)): {
name: roleAssignments[i].roleDefinitionId
}]

You are getting duplicate existing references due to several role assignments referencing the same definition.

So either modify your template to not get duplicates, use resourceId() (not recommended) or make a module to assign a single role and loop over that module.

[jeskew]

There's nothing wrong with using resourceId() if all you need is the ID of a resource; that would be my recommendation for this use case:

resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for i in range(0, length(roleAssignments)): {
  name: roleAssignGuid[i]
  scope: vm
  properties: {
    principalId: roleAssignments[i].principalId
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', roleAssignments[i].roleDefinitionId)
  }
}]