Skip to content

[Az.Resources] Fix Get-AzRoleDefinition returning null Condition for multi-permission roles #29060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
atomassi wants to merge 12 commits into
base: main
Choose a base branch
from
Open

[Az.Resources] Fix Get-AzRoleDefinition returning null Condition for multi-permission roles #29060

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
05a8664
Fix Get-AzRoleDefinition flattening permissions and losing per-permis…
atomassi Jan 14, 2026
ed8fac5
Add issue reference and expand ABAC acronym in ChangeLog
atomassi Jan 14, 2026
39a1429
Add JsonIgnore to PSPermission string helper properties
atomassi Jan 14, 2026
5b3590d
Fix ChangeLog format and add null checks to PSPermission
atomassi Jan 14, 2026
1619580
Fix tests, help docs, and add breaking change exceptions for RoleDefi…
atomassi Jan 15, 2026
85f3d11
Update ChangeLog to clarify breaking changes
atomassi Jan 15, 2026
b2e70de
Add validation tests and InvalidPermissions error message
atomassi Jan 15, 2026
8dd966c
Add E2E tests for new Permissions array format on role definitions
atomassi Jan 15, 2026
36deca4
Add BreakingChangeIssues.csv for PSRoleDefinition property changes
atomassi Jan 15, 2026
220beab
Update help documentation for PSRoleDefinition Permissions structure
atomassi Jan 15, 2026
d8c7019
Fix help doc format for platyPS
atomassi Jan 15, 2026
002e20e
Expand ABAC acronym on first use in ChangeLog
atomassi Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions src/Resources/Resources.Test/Resources/DataActionsRoleDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,17 @@
{
"Name": "CustomRole Tests Role New",
"Description": "Test role",
"Actions": [],
"NotActions": [],
"DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
],
"NotDataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
"Permissions": [
{
"Actions": [],
"NotActions": [],
"DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
],
"NotDataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
]
}
],
"AssignableScopes": ["/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590"]
}
12 changes: 8 additions & 4 deletions src/Resources/Resources.Test/Resources/InvalidRoleDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,14 @@
"Name": "Another Invalid test role",
"Id": "85E460B3-89E9-48BA-9DCD-A8A99D64A674",
"Description": "Test role",
"Actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Support/*"
"Permissions": [
{
"Actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Support/*"
],
"NotActions": []
}
],
"NotActions": [],
"AssignableScopes": ["/subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/ResourceGroups"]
}
12 changes: 8 additions & 4 deletions src/Resources/Resources.Test/Resources/NewRoleDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,14 @@
{
"Name": "CustomRole Tests Role",
"Description": "Test role",
"Actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Support/*"
"Permissions": [
{
"Actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Support/*"
],
"NotActions": []
}
],
"NotActions": [],
"AssignableScopes": ["/subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f"]
}
16 changes: 16 additions & 0 deletions src/Resources/Resources.Test/Resources/PermissionsFormatRoleDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"Name": "CustomRole Permissions Format Test",
"Description": "Test role for new Permissions array format",
"Permissions": [
{
"Actions": [
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/deployments/*"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": []
}
],
"AssignableScopes": ["/subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f"]
}
12 changes: 8 additions & 4 deletions src/Resources/Resources.Test/Resources/RoleDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,15 @@
"Name": "Another tests role",
"Id": "85E460B3-89E9-48BA-9DCD-A8A99D64A674",
"Description": "Test role",
"Actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Support/*"
"Permissions": [
{
"Actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Support/*"
],
"NotActions": []
}
],
"NotActions": [],
"AssignableScopes": ["/subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f",
"/subscriptions/4004a9fd-d58e-48dc-aeb2-4a4aec58606f/ResourceGroups/rbactest"]
}
2 changes: 1 addition & 1 deletion src/Resources/Resources.Test/ScenarioTests/RoleAssignmentTests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,7 +435,7 @@ function Test-RaPropertiesValidation
$roleDef = Get-AzRoleDefinition -Name "Reader"
$roleDef.Id = "ff9cd1ab-d763-486f-b253-51a816c92aaf"
$roleDef.Name = "Reader vm For Test"
$roleDef.Actions.Add("Microsoft.ClassicCompute/virtualMachines/restart/action")
$roleDef.Permissions[0].Actions.Add("Microsoft.ClassicCompute/virtualMachines/restart/action")
$roleDef.Description = "Read, monitor and restart virtual machines"
$roleDef.AssignableScopes[0] = '/subscriptions/'+$subscription[0].Id

Expand Down
21 changes: 21 additions & 0 deletions src/Resources/Resources.Test/ScenarioTests/RoleDefinitionTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,27 @@ public void RDWithConditionGetScenario()
TestRunner.RunTestScript("Test-RDWithAbacConditionsGet");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RDNewPermissionsFormatCreate()
{
TestRunner.RunTestScript("Test-RDNewPermissionsFormatCreate");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RDNewPermissionsFormatUpdate()
{
TestRunner.RunTestScript("Test-RDNewPermissionsFormatUpdate");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RDNewPermissionsFormatDelete()
{
TestRunner.RunTestScript("Test-RDNewPermissionsFormatDelete");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RdValidateInputParameters()
Expand Down
Loading
Loading