0gis0 / azure-dev-center-demos Goto Github PK

The script that creates the azure image builder identity and role seems to have an error when running, where if assigning the role by custom role name errors out (can not find role definition - e.g. "Azure Image Builder Service Image Creation Role").

Link to code: https://github.com/raykao/azure-dev-box-demo/blob/76bcd0fad388087ab8ccbefa385eddb13b509a43/scripts/02-custom-devbox/image-builder/03-create-azure-image-builder-identity-and-role.sh#L44-L45

However if using the uuid of the created custom role, this command succeeds as expected.

Suggested fix:

• use role uuid in the --role parameter flag in az role assignment create instead of the display name for role?

On certain commands, the azure cli will leverage the Microsoft Graph API to check if an entity (app/user) exists in the Entra (Artist formerly known as Azure Active Directory/AAD) tenant.

As such a user/spn must have graph API permissions to do so via the cli. Otherwise there must be steps to manually add the entity with the required permission on the correct resource scope.

As an example:
https://github.com/0GiS0/azure-dev-box-demo/blob/76bcd0fad388087ab8ccbefa385eddb13b509a43/scripts/02-custom-devbox/image-builder/01-create-azure-compute-gallery.sh#L12

This line using the --assignee parameter would require Microsoft Graph API access to query for the assignee resource object and then assign the role. You will see/receive an error like this:

Failed to query xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx by invoking Graph API. If you don't have permission to query Graph API, please specify --assignee-object-id and --assignee-principal-type.

Workaround:

• In a workshop scenario you can manually add the permission/role assignment on the resource group via the Azure Portal if a user receives Graph API permission error in the CLI.

Potential Fixes:

• Add/enable Graph API permission for the user/spn
• use the --assignee-object-id and --assignee-principal-type ServicePrincipal flags instead of --assignee only flag to bypass Msft Graph API calls