Skip to content

Commit 4d6d480

Browse files
jiaslijiasli
authored
[Role] Add az role definition show command (#30593)
1 parent 1215c0f commit 4d6d480

File tree

6 files changed

+169
-7
lines changed

6 files changed

+169
-7
lines changed

‎src/azure-cli/azure/cli/command_modules/role/_help.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -864,6 +864,16 @@
864864
short-summary: List role definitions.
865865
"""
866866

867+
helps['role definition show'] = """
868+
type: command
869+
short-summary: Show a role definition.
870+
examples:
871+
- name: Show the 'Reader' role definition with its name (GUID).
872+
text: az role definition show --scope /subscriptions/00000000-0000-0000-0000-000000000000 --name acdd72a7-3385-48ef-bd42-f606fba81ae7
873+
- name: Show the 'Reader' role definition with its resource ID.
874+
text: az role definition show --id /subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7
875+
"""
876+
867877
helps['role definition update'] = """
868878
type: command
869879
short-summary: Update a role definition.

‎src/azure-cli/azure/cli/command_modules/role/_params.py‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -369,8 +369,23 @@ class PrincipalType(str, Enum):
369369
c.argument('yes', options_list=['--yes', '-y'], action='store_true', help='Currently no-op.')
370370

371371
with self.argument_context('role definition') as c:
372-
c.argument('role_definition_id', options_list=['--name', '-n'], help='the role definition name')
373372
c.argument('custom_role_only', arg_type=get_three_state_flag(), help='custom roles only(vs. build-in ones)')
374373
c.argument('role_definition', help="json formatted content which defines the new role.")
374+
375+
with self.argument_context('role definition list') as c:
376+
c.argument('name', arg_type=name_arg_type, completer=get_role_definition_name_completion_list,
377+
help="Matches the role definition's name (GUID) or roleName (e.g. 'Reader') property. "
378+
"If a GUID is provided, for better performance, use `az role definition show` command.")
379+
380+
with self.argument_context('role definition show') as c:
381+
c.argument('name', arg_type=name_arg_type, help="The role definition's name (GUID)")
382+
c.argument('role_id', options_list=['--id'],
383+
help='The fully qualified role definition ID. Use the format, '
384+
'/subscriptions/{guid}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} '
385+
'for subscription level role definitions, or '
386+
'/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} '
387+
'for tenant level role definitions.')
388+
389+
with self.argument_context('role definition delete') as c:
375390
c.argument('name', arg_type=name_arg_type, completer=get_role_definition_name_completion_list,
376391
help="Matches the role definition's name (GUID) or roleName (e.g. 'Reader') property.")

‎src/azure-cli/azure/cli/command_modules/role/commands.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ def load_command_table(self, _):
6969
g.custom_command('delete', 'delete_role_definition')
7070
g.custom_command('create', 'create_role_definition')
7171
g.custom_command('update', 'update_role_definition')
72+
g.custom_show_command('show', 'show_role_definition')
7273

7374
with self.command_group('role assignment') as g:
7475
g.custom_command('delete', 'delete_role_assignments', validator=process_assignment_namespace)

‎src/azure-cli/azure/cli/command_modules/role/custom.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,20 @@ def list_role_definitions(cmd, name=None, resource_group_name=None, scope=None,
7171
return _search_role_definitions(cmd.cli_ctx, definitions_client, name, [scope], custom_role_only)
7272

7373

74+
def show_role_definition(cmd, scope=None, name=None, role_id=None):
75+
if not any((scope, name, role_id)):
76+
raise CLIError('Usage error: Provide --scope and --name, or --id')
77+
if not role_id and not (name and scope):
78+
raise CLIError('Usage error: Provide both --scope and --name')
79+
80+
definitions_client = _auth_client_factory(cmd.cli_ctx, scope).role_definitions
81+
# https://learn.microsoft.com/en-us/rest/api/authorization/role-definitions/get-by-id?view=rest-authorization-2022-04-01&tabs=HTTP
82+
if role_id:
83+
return definitions_client.get_by_id(role_id)
84+
# https://learn.microsoft.com/en-us/rest/api/authorization/role-definitions/get?view=rest-authorization-2022-04-01&tabs=HTTP
85+
return definitions_client.get(scope, name)
86+
87+
7488
def create_role_definition(cmd, role_definition):
7589
return _create_update_role_definition(cmd, role_definition, for_update=False)
7690

‎src/azure-cli/azure/cli/command_modules/role/tests/latest/recordings/test_built_in_role_definition_scenario.yaml‎

Lines changed: 109 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,98 @@
11
interactions:
2+
- request:
3+
body: null
4+
headers:
5+
Accept:
6+
- application/json
7+
Accept-Encoding:
8+
- gzip, deflate
9+
CommandName:
10+
- role definition show
11+
Connection:
12+
- keep-alive
13+
ParameterSetName:
14+
- --scope --name
15+
User-Agent:
16+
- AZURECLI/2.68.0 azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.26100-SP0)
17+
method: GET
18+
uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7?api-version=2022-05-01-preview
19+
response:
20+
body:
21+
string: '{"properties":{"roleName":"Reader","type":"BuiltInRole","description":"View
22+
all resources, but does not allow you to make any changes.","assignableScopes":["/"],"permissions":[{"actions":["*/read"],"notActions":[],"dataActions":[],"notDataActions":[]}],"createdOn":"2015-02-02T21:55:09.8806423Z","updatedOn":"2021-11-11T20:13:47.8628684Z","createdBy":null,"updatedBy":null},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7","type":"Microsoft.Authorization/roleDefinitions","name":"acdd72a7-3385-48ef-bd42-f606fba81ae7"}'
23+
headers:
24+
cache-control:
25+
- no-cache
26+
content-length:
27+
- '615'
28+
content-type:
29+
- application/json; charset=utf-8
30+
date:
31+
- Tue, 14 Jan 2025 08:31:34 GMT
32+
expires:
33+
- '-1'
34+
pragma:
35+
- no-cache
36+
strict-transport-security:
37+
- max-age=31536000; includeSubDomains
38+
x-cache:
39+
- CONFIG_NOCACHE
40+
x-content-type-options:
41+
- nosniff
42+
x-ms-ratelimit-remaining-subscription-global-reads:
43+
- '3749'
44+
x-msedge-ref:
45+
- 'Ref A: C061AE716EE2452680D4CB1A7E20FF7A Ref B: MAA201060515053 Ref C: 2025-01-14T08:31:33Z'
46+
status:
47+
code: 200
48+
message: OK
49+
- request:
50+
body: null
51+
headers:
52+
Accept:
53+
- application/json
54+
Accept-Encoding:
55+
- gzip, deflate
56+
CommandName:
57+
- role definition show
58+
Connection:
59+
- keep-alive
60+
ParameterSetName:
61+
- --id
62+
User-Agent:
63+
- AZURECLI/2.68.0 azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.26100-SP0)
64+
method: GET
65+
uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7?api-version=2022-05-01-preview
66+
response:
67+
body:
68+
string: '{"properties":{"roleName":"Reader","type":"BuiltInRole","description":"View
69+
all resources, but does not allow you to make any changes.","assignableScopes":["/"],"permissions":[{"actions":["*/read"],"notActions":[],"dataActions":[],"notDataActions":[]}],"createdOn":"2015-02-02T21:55:09.8806423Z","updatedOn":"2021-11-11T20:13:47.8628684Z","createdBy":null,"updatedBy":null},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7","type":"Microsoft.Authorization/roleDefinitions","name":"acdd72a7-3385-48ef-bd42-f606fba81ae7"}'
70+
headers:
71+
cache-control:
72+
- no-cache
73+
content-length:
74+
- '615'
75+
content-type:
76+
- application/json; charset=utf-8
77+
date:
78+
- Tue, 14 Jan 2025 08:31:34 GMT
79+
expires:
80+
- '-1'
81+
pragma:
82+
- no-cache
83+
strict-transport-security:
84+
- max-age=31536000; includeSubDomains
85+
x-cache:
86+
- CONFIG_NOCACHE
87+
x-content-type-options:
88+
- nosniff
89+
x-ms-ratelimit-remaining-subscription-global-reads:
90+
- '3749'
91+
x-msedge-ref:
92+
- 'Ref A: B175DFADEA244A9596A747FEEEFB2C5D Ref B: MAA201060515021 Ref C: 2025-01-14T08:31:34Z'
93+
status:
94+
code: 200
95+
message: OK
296
- request:
397
body: null
498
headers:
@@ -28,7 +122,7 @@ interactions:
28122
content-type:
29123
- application/json; charset=utf-8
30124
date:
31-
- Fri, 10 Jan 2025 08:17:57 GMT
125+
- Tue, 14 Jan 2025 08:31:34 GMT
32126
expires:
33127
- '-1'
34128
pragma:
@@ -42,7 +136,7 @@ interactions:
42136
x-ms-ratelimit-remaining-subscription-global-reads:
43137
- '3749'
44138
x-msedge-ref:
45-
- 'Ref A: 7F6EAE2E153640A894E4F7971729E661 Ref B: MAA201060516025 Ref C: 2025-01-10T08:17:58Z'
139+
- 'Ref A: C294E8E0D0AA4D70B126A61CF34BABD9 Ref B: MAA201060513021 Ref C: 2025-01-14T08:31:35Z'
46140
status:
47141
code: 200
48142
message: OK
@@ -1638,16 +1732,25 @@ interactions:
16381732
Autonomous Database Administrator\",\"type\":\"BuiltInRole\",\"description\":\"Grants
16391733
full access to manage all Autonomous Database resources\",\"assignableScopes\":[\"/\"],\"permissions\":[{\"actions\":[\"Oracle.Database/autonomousDatabases/*/read\",\"Oracle.Database/autonomousDatabases/*/write\",\"Oracle.Database/autonomousDatabases/*/delete\",\"Oracle.Database/autonomousDatabases/*/action\",\"Oracle.Database/Locations/*/read\",\"Oracle.Database/Locations/*/write\",\"Oracle.Database/Operations/read\",\"Oracle.Database/oracleSubscriptions/*/read\",\"Oracle.Database/oracleSubscriptions/*/action\",\"Microsoft.Resources/subscriptions/resourceGroups/read\",\"Microsoft.Resources/deployments/*\",\"Microsoft.Network/virtualNetworks/read\",\"Microsoft.Network/virtualNetworks/subnets/read\",\"Microsoft.Network/virtualNetworks/subnets/write\",\"Microsoft.Network/locations/operations/read\"],\"notActions\":[],\"dataActions\":[],\"notDataActions\":[]}],\"createdOn\":\"2024-12-04T16:02:04.8857247Z\",\"updatedOn\":\"2024-12-04T16:02:04.8857247Z\",\"createdBy\":null,\"updatedBy\":null},\"id\":\"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/59c05558-2358-462d-ba19-afbd7118936d\",\"type\":\"Microsoft.Authorization/roleDefinitions\",\"name\":\"59c05558-2358-462d-ba19-afbd7118936d\"},{\"properties\":{\"roleName\":\"Azure
16401734
AI Safety Evaluator\",\"type\":\"BuiltInRole\",\"description\":\"This role
1641-
can perform all actions under workspace evaluations and simulations.\",\"assignableScopes\":[\"/\"],\"permissions\":[{\"actions\":[\"Microsoft.MachineLearningServices/workspaces/evaluations/*\",\"Microsoft.MachineLearningServices/workspaces/simulations/*\"],\"notActions\":[],\"dataActions\":[],\"notDataActions\":[]}],\"createdOn\":\"2024-12-18T16:29:45.1650072Z\",\"updatedOn\":\"2024-12-18T16:29:45.1650072Z\",\"createdBy\":null,\"updatedBy\":null},\"id\":\"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/11102f94-c441-49e6-a78b-ef80e0188abc\",\"type\":\"Microsoft.Authorization/roleDefinitions\",\"name\":\"11102f94-c441-49e6-a78b-ef80e0188abc\"}]}"
1735+
can perform all actions under workspace evaluations and simulations.\",\"assignableScopes\":[\"/\"],\"permissions\":[{\"actions\":[\"Microsoft.MachineLearningServices/workspaces/evaluations/*\",\"Microsoft.MachineLearningServices/workspaces/simulations/*\"],\"notActions\":[],\"dataActions\":[],\"notDataActions\":[]}],\"createdOn\":\"2024-12-18T16:29:45.1650072Z\",\"updatedOn\":\"2024-12-18T16:29:45.1650072Z\",\"createdBy\":null,\"updatedBy\":null},\"id\":\"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/11102f94-c441-49e6-a78b-ef80e0188abc\",\"type\":\"Microsoft.Authorization/roleDefinitions\",\"name\":\"11102f94-c441-49e6-a78b-ef80e0188abc\"},{\"properties\":{\"roleName\":\"Container
1736+
Registry Tasks Contributor\",\"type\":\"BuiltInRole\",\"description\":\"Provides
1737+
permissions to configure, read, list, trigger, or cancel Container Registry
1738+
Tasks, Task Runs, Task Logs, Quick Runs, Quick Builds, and Task Agent Pools.
1739+
Permissions granted for Tasks management can be used for full registry data
1740+
plane permissions including reading/writing/deleting container images in registries.
1741+
Permissions granted for Tasks management can also be used to run customer
1742+
authored build directives and run scripts to build software artifacts.\",\"assignableScopes\":[\"/\"],\"permissions\":[{\"actions\":[\"Microsoft.ContainerRegistry/registries/agentpools/read\",\"Microsoft.ContainerRegistry/registries/agentpools/write\",\"Microsoft.ContainerRegistry/registries/agentpools/delete\",\"Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action\",\"Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read\",\"Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read\",\"Microsoft.ContainerRegistry/registries/tasks/read\",\"Microsoft.ContainerRegistry/registries/tasks/write\",\"Microsoft.ContainerRegistry/registries/tasks/delete\",\"Microsoft.ContainerRegistry/registries/tasks/listDetails/action\",\"Microsoft.ContainerRegistry/registries/scheduleRun/action\",\"Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action\",\"Microsoft.ContainerRegistry/registries/runs/read\",\"Microsoft.ContainerRegistry/registries/runs/write\",\"Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action\",\"Microsoft.ContainerRegistry/registries/runs/cancel/action\",\"Microsoft.ContainerRegistry/registries/taskruns/read\",\"Microsoft.ContainerRegistry/registries/taskruns/write\",\"Microsoft.ContainerRegistry/registries/taskruns/delete\",\"Microsoft.ContainerRegistry/registries/taskruns/listDetails/action\",\"Microsoft.ContainerRegistry/registries/taskruns/operationStatuses/read\",\"Microsoft.Resources/deployments/*\",\"Microsoft.Resources/subscriptions/resourceGroups/read\",\"Microsoft.ContainerRegistry/registries/read\"],\"notActions\":[],\"dataActions\":[],\"notDataActions\":[]}],\"createdOn\":\"2025-01-13T16:06:06.8277690Z\",\"updatedOn\":\"2025-01-13T16:06:06.8277690Z\",\"createdBy\":null,\"updatedBy\":null},\"id\":\"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/fb382eab-e894-4461-af04-94435c366c3f\",\"type\":\"Microsoft.Authorization/roleDefinitions\",\"name\":\"fb382eab-e894-4461-af04-94435c366c3f\"},{\"properties\":{\"roleName\":\"Azure
1743+
Backup Snapshot Contributor\",\"type\":\"BuiltInRole\",\"description\":\"Provide
1744+
permissions to backup identity to manage RPC snapshots\",\"assignableScopes\":[\"/\"],\"permissions\":[{\"actions\":[\"Microsoft.Compute/virtualMachines/read\",\"Microsoft.Compute/virtualMachines/write\",\"Microsoft.Compute/restorePointCollections/read\",\"Microsoft.Compute/restorePointCollections/write\",\"Microsoft.Compute/restorePointCollections/restorePoints/write\",\"Microsoft.Compute/restorePointCollections/restorePoints/read\",\"Microsoft.Compute/disks/read\",\"Microsoft.Compute/disks/write\",\"Microsoft.Compute/disks/delete\",\"Microsoft.Compute/disks/beginGetAccess/action\"],\"notActions\":[],\"dataActions\":[],\"notDataActions\":[]}],\"createdOn\":\"2025-01-13T16:06:06.8277690Z\",\"updatedOn\":\"2025-01-13T16:06:06.8277690Z\",\"createdBy\":null,\"updatedBy\":null},\"id\":\"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/afc680e2-a938-412d-b213-9a49efa7fb83\",\"type\":\"Microsoft.Authorization/roleDefinitions\",\"name\":\"afc680e2-a938-412d-b213-9a49efa7fb83\"}]}"
16421745
headers:
16431746
cache-control:
16441747
- no-cache
16451748
content-length:
1646-
- '792919'
1749+
- '796487'
16471750
content-type:
16481751
- application/json; charset=utf-8
16491752
date:
1650-
- Fri, 10 Jan 2025 08:17:58 GMT
1753+
- Tue, 14 Jan 2025 08:31:35 GMT
16511754
expires:
16521755
- '-1'
16531756
pragma:
@@ -1661,7 +1764,7 @@ interactions:
16611764
x-ms-ratelimit-remaining-subscription-global-reads:
16621765
- '3749'
16631766
x-msedge-ref:
1664-
- 'Ref A: 57281F819E2749AF82F1DCE477577B17 Ref B: MAA201060514053 Ref C: 2025-01-10T08:17:58Z'
1767+
- 'Ref A: CED333ECC3644E28BEA0E8BD9D1C7ABC Ref B: MAA201060515023 Ref C: 2025-01-14T08:31:35Z'
16651768
status:
16661769
code: 200
16671770
message: OK

‎src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,25 @@ class RoleDefinitionScenarioTest(RoleScenarioTestBase):
200200

201201
@AllowLargeResponse()
202202
def test_built_in_role_definition_scenario(self):
203+
self.kwargs['sub_scope'] = '/subscriptions/{}'.format(self.cmd('account show').get_output_in_json()['id'])
204+
205+
# Show Reader built-in role definition by scope and name
206+
self.cmd('role definition show --scope {sub_scope} --name acdd72a7-3385-48ef-bd42-f606fba81ae7',
207+
checks=[
208+
self.check('name', 'acdd72a7-3385-48ef-bd42-f606fba81ae7'),
209+
self.check('roleName', 'Reader'),
210+
self.check('roleType', 'BuiltInRole')
211+
])
212+
213+
# Show Reader built-in role definition by resource ID
214+
self.cmd('role definition show --id '
215+
'{sub_scope}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7',
216+
checks=[
217+
self.check('name', 'acdd72a7-3385-48ef-bd42-f606fba81ae7'),
218+
self.check('roleName', 'Reader'),
219+
self.check('roleType', 'BuiltInRole')
220+
])
221+
203222
# List Reader built-in role definition by roleName
204223
self.cmd('role definition list --name Reader',
205224
checks=[

0 commit comments

Comments
 (0)