CODEWITHSUNDEEP
azureazure-cosmosdbrolesazure-rm-template
Sonam Mohite
Sonam Mohite

Reputation: 903

Assign Roles via ARM Template to cosmos db

I'm trying to assign the role to 'Cosmos Db account' by using following template.

 {
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "principalId": {
            "type": "string",
            "defaultValue": "gb9e32f1-678f-4552-ae0a-0000f765aaaa",
            "metadata": {
                "description": ""
            }
        },
        "CosmosDbAccountName": {
            "type": "string",
            "defaultValue": "cosmosdbaccount",
            "metadata": {
                "description": "Cosmos Db Account name"
            }
        },
        "RoleType": {
            "defaultValue" : "Contributor",
            "type": "string",
            "metadata": {
                "description": "Built-in role to assign"
            },
            "allowedValues" : [
                "Contributor"
            ]
        }
    },
    "variables": {
         "Scope": "[concat(parameters('CosmosDbAccountName'),'/Microsoft.Authorization/',guid(subscription().subscriptionId))]"
     
     },

    "resources": [
        {
            "type": "Microsoft.DocumentDB/databaseAccounts/providers/roleAssignments",
            "name": "[variables('Scope')]",
            "apiVersion":"2020-04-01-preview",
            "properties": {
                "RoleDefinitionId":"/subscriptions/[subscription().subscriptionId]/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
                "principalId":  "[parameters('principalId')]"
            }
        }
    ]
}

I am currently getting error as

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"BadRequest","message":"{\r\n "error": {\r\n "code": "RoleAssignmentUpdateNotPermitted",\r\n "message": "Tenant ID, application ID, principal ID, and scope are not allowed to be updated."\r\n }\r\n}"}]}

Upvotes: 2

Views: 1897

Answers (1)

Jagrati Modi
Jagrati Modi

Reputation: 2088

I think there is existing role assignment with the same name that you are trying to create through this template and it ends up giving the error for "RoleAssignmentUpdateNotPermitted".

Few changes to your template can solve your problem like generating a unique GUID and then concat it with cosmos DB account name, Please try the below updated template:

   {
        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "parameters": {
            "principalId": {
                "type": "string",
                "defaultValue": "gb9e32f1-678f-4552-ae0a-0000f765aaaa",
                "metadata": {
                    "description": ""
                }
            },
            "CosmosDbAccountName": {
                "type": "string",
                "defaultValue": "cosmosdbaccount",
                "metadata": {
                    "description": "Cosmos Db Account name"
                }
            },
            "RoleType": {
                "defaultValue" : "Contributor",
                "type": "string",
                "metadata": {
                    "description": "Built-in role to assign"
                },
                "allowedValues" : [
                    "Contributor"
                ]
            },
            "guid": {
                "defaultValue": "[newGuid()]",
                "type": "String"
            }
        },
        "variables": {
             "Scope": "[concat(parameters('CosmosDbAccountName'),'/Microsoft.Authorization/', parameters('guid'))]"
         
         },
    
        "resources": [
            {
                "type": "Microsoft.DocumentDB/databaseAccounts/providers/roleAssignments",
                "name": "[variables('Scope')]",
                "apiVersion":"2020-04-01-preview",
                "properties": {
                    "RoleDefinitionId":"/subscriptions/[subscription().subscriptionId]/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
                    "principalId":  "[parameters('principalId')]"
                }
            }
        ]
    }

Upvotes: 4

Related Questions