Skip to content

Commit 14e91af

Browse files
rolyonrolyon
committed
Improved custom role creation using Bicep
1 parent d4731fb commit 14e91af

File tree

1 file changed

+67
-35
lines changed

1 file changed

+67
-35
lines changed

‎articles/role-based-access-control/custom-roles-bicep.md

Lines changed: 67 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: rolyon
66
manager: amycolannino
77
ms.service: role-based-access-control
88
ms.topic: how-to
9-
ms.date: 12/01/2023
9+
ms.date: 02/15/2024
1010
ms.author: rolyon
1111
ms.custom: devx-track-azurepowershell, devx-track-azurecli, devx-track-bicep
1212
#Customer intent: As an IT admin, I want to create custom and/or roles using Bicep so that I can start automating custom role processes.
@@ -37,7 +37,45 @@ The Bicep file used in this article is from [Azure Quickstart Templates](https:/
3737

3838
The scope where this custom role can be assigned is set to the current subscription.
3939

40-
:::code language="bicep" source="~/quickstart-templates/subscription-deployments/create-role-def/main.bicep":::
40+
A custom role requires a unique ID. The ID can be generated with the [guid()](../azure-resource-manager/bicep/bicep-functions-string.md#guid) function. Since a custom role also requires a [unique display name](custom-roles.md#custom-role-properties) for the tenant, you can use the role name as a parameter for the `guid()` function to create a [deterministic GUID](../azure-resource-manager/bicep/scenarios-rbac.md#name). A deterministic GUID is useful if you later need to update the custom role using the same Bicep file.
41+
42+
```bicep
43+
targetScope = 'subscription'
44+
45+
@description('Array of actions for the roleDefinition')
46+
param actions array = [
47+
'Microsoft.Resources/subscriptions/resourceGroups/read'
48+
]
49+
50+
@description('Array of notActions for the roleDefinition')
51+
param notActions array = []
52+
53+
@description('Friendly name of the role definition')
54+
param roleName string = 'Custom Role - RG Reader'
55+
56+
@description('Detailed description of the role definition')
57+
param roleDescription string = 'Subscription Level Deployment of a Role Definition'
58+
59+
var roleDefId = guid(roleName)
60+
61+
resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
62+
name: roleDefId
63+
properties: {
64+
roleName: roleName
65+
description: roleDescription
66+
type: 'customRole'
67+
permissions: [
68+
{
69+
actions: actions
70+
notActions: notActions
71+
}
72+
]
73+
assignableScopes: [
74+
subscription().id
75+
]
76+
}
77+
}
78+
```
4179

4280
The resource defined in the Bicep file is:
4381

@@ -46,29 +84,39 @@ The resource defined in the Bicep file is:
4684
## Deploy the Bicep file
4785

4886
1. Save the Bicep file as **main.bicep** to your local computer.
49-
1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.
87+
88+
1. Create a variable named **myActions** with the actions for the roleDefinition.
5089

5190
# [CLI](#tab/CLI)
5291

5392
```azurecli-interactive
54-
$myActions='("Microsoft.Resources/resources/read","Microsoft.Resources/subscriptions/resourceGroups/read")'
55-
56-
az deployment sub create --location eastus --name customRole --template-file main.bicep --parameters actions=$myActions
93+
$myActions='["Microsoft.Resources/subscriptions/resourceGroups/read"]'
5794
```
5895
5996
# [PowerShell](#tab/PowerShell)
6097
6198
```azurepowershell-interactive
62-
$myActions = @("Microsoft.Resources/resources/read","Microsoft.Resources/subscriptions/resourceGroups/read")
99+
$myActions = @("Microsoft.Resources/subscriptions/resourceGroups/read")
100+
```
101+
102+
---
103+
104+
1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.
105+
106+
# [CLI](#tab/CLI)
107+
108+
```azurecli-interactive
109+
az deployment sub create --location eastus --name customRole --template-file ./main.bicep --parameters actions=$myActions
110+
```
111+
112+
# [PowerShell](#tab/PowerShell)
63113
114+
```azurepowershell-interactive
64115
New-AzSubscriptionDeployment -Location eastus -Name customRole -TemplateFile ./main.bicep -actions $myActions
65116
```
66117
67118
---
68119
69-
> [!NOTE]
70-
> Create a variable called **myActions** and then pass that variable. Replace the sample actions with the actions for the roleDefinition.
71-
72120
When the deployment finishes, you should see a message indicating the deployment succeeded.
73121
74122
## Review deployed resources
@@ -91,53 +139,36 @@ Get-AzRoleDefinition "Custom Role - RG Reader"
91139

92140
## Update a custom role
93141

94-
Similar to creating a custom role, you can update an existing custom role using Bicep. To update a custom role, you need to specify the role you want to update.
142+
Similar to creating a custom role, you can update an existing custom role using Bicep. To update a custom role, you need to specify the role you want to update. If you previously created the custom role in Bicep with a unique role ID that is [deterministic](../azure-resource-manager/bicep/scenarios-rbac.md#name), you can use the same Bicep file and specify the custom role by just using the display name.
95143

96-
Here are the changes you would need to make to the previous Bicep file to update the custom role.
97-
98-
1. Include the role ID as a parameter.
99-
100-
```bicep
101-
...
102-
@description('ID of the role definition')
103-
param roleDefName string
104-
...
105-
106-
```
107-
108-
2. Remove the roleDefName variable. You'll get a warning if you have a parameter and variable with the same name.
109-
3. Use Azure CLI or Azure PowerShell to get the roleDefName.
144+
1. Specify the updated actions.
110145

111146
# [CLI](#tab/CLI)
112147

113148
```azurecli-interactive
114-
az role definition list --name "Custom Role - RG Reader"
149+
$myActions='["Microsoft.Resources/resources/read","Microsoft.Resources/subscriptions/resourceGroups/read"]'
115150
```
116151
117152
# [PowerShell](#tab/PowerShell)
118153
119154
```azurepowershell-interactive
120-
Get-AzRoleDefinition -Name "Custom Role - RG Reader"
155+
$myActions = @(""Microsoft.Resources/resources/read","Microsoft.Resources/subscriptions/resourceGroups/read"")
121156
```
122157
123-
---
158+
---
124159
125-
4. Use Azure CLI or Azure PowerShell to deploy the updated Bicep file, replacing **\<name-id\>** with the roleDefName, and replacing the sample actions with the updated actions for the roleDefinition.
160+
1. Use Azure CLI or Azure PowerShell to update roleDefinition.
126161
127162
# [CLI](#tab/CLI)
128163
129164
```azurecli-interactive
130-
$myActions='("Microsoft.Resources/resources/read","Microsoft.Resources/subscriptions/resourceGroups/read")'
131-
132-
az deployment sub create --location eastus --name customrole --template-file main.bicep --parameters actions=$myActions roleDefName="name-id" roleName="Custom Role - RG Reader"
165+
az deployment sub create --location eastus --name customrole --template-file ./main.bicep --parameters actions=$myActions roleName="Custom Role - RG Reader"
133166
```
134167
135168
# [PowerShell](#tab/PowerShell)
136169
137170
```azurepowershell-interactive
138-
$myActions = @(""Microsoft.Resources/resources/read","Microsoft.Resources/subscriptions/resourceGroups/read"")
139-
140-
New-AzSubscriptionDeployment -Location eastus -Name customrole -TemplateFile ./main.bicep -actions $myActions -roleDefName "name-id" -roleName "Custom Role - RG Reader"
171+
New-AzSubscriptionDeployment -Location eastus -Name customrole -TemplateFile ./main.bicep -actions $myActions -roleName "Custom Role - RG Reader"
141172
```
142173
143174
---
@@ -167,3 +198,4 @@ Remove-AzRoleDefinition -Name "Custom Role - RG Reader"
167198

168199
- [Understand Azure role definitions](role-definitions.md)
169200
- [Bicep documentation](../azure-resource-manager/bicep/overview.md)
201+
- [Create a new role def via a subscription level deployment](https://github.com/Azure/azure-quickstart-templates/tree/master/subscription-deployments/create-role-def)

0 commit comments

Comments
 (0)