diff --git a/src/azure-cli/azure/cli/command_modules/role/_help.py b/src/azure-cli/azure/cli/command_modules/role/_help.py index a21fa63e1d8..4d8bae3f1fb 100644 --- a/src/azure-cli/azure/cli/command_modules/role/_help.py +++ b/src/azure-cli/azure/cli/command_modules/role/_help.py @@ -854,9 +854,10 @@ type: command short-summary: Delete a role definition. examples: - - name: Delete a role definition. (autogenerated) - text: az role definition delete --name MyRole - crafted: true + - name: Delete a role definition by roleName. + text: az role definition delete --scope /subscriptions/00000000-0000-0000-0000-000000000000 --name MyRole + - name: Delete a role definition by name (GUID). + text: az role definition delete --scope /subscriptions/00000000-0000-0000-0000-000000000000 --name 00000000-0000-0000-0000-000000000000 """ helps['role definition list'] = """ diff --git a/src/azure-cli/azure/cli/command_modules/role/custom.py b/src/azure-cli/azure/cli/command_modules/role/custom.py index f7731268fe7..9f9b751fc54 100644 --- a/src/azure-cli/azure/cli/command_modules/role/custom.py +++ b/src/azure-cli/azure/cli/command_modules/role/custom.py @@ -134,6 +134,9 @@ def delete_role_definition(cmd, name, resource_group_name=None, scope=None, definitions_client = _auth_client_factory(cmd.cli_ctx, scope).role_definitions scope = _build_role_scope(resource_group_name, scope, definitions_client._config.subscription_id) + if is_guid(name): + definitions_client.delete(scope, name) + return roles = _search_role_definitions(cmd.cli_ctx, definitions_client, name, [scope], custom_role_only) for r in roles: definitions_client.delete(role_definition_id=r.name, scope=scope) diff --git a/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py b/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py index 2b295151c9c..e18f458be20 100644 --- a/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py +++ b/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py @@ -248,11 +248,26 @@ def test_custom_role_definition_scenario(self): self.kwargs.update({ 'sub': subscription_id, 'role': role_name, - 'template': temp_file.replace('\\', '\\\\') + 'template': temp_file.replace('\\', '\\\\'), + 'scope': "/subscriptions/{}".format(subscription_id) }) # a few 'sleep' here to handle server replicate latency. It is no-op under playback with mock.patch('azure.cli.command_modules.role.custom._gen_guid', side_effect=self.create_guid): + # Operate on name (GUID) + role = self.cmd('role definition create --role-definition {template}', checks=[ + self.check('permissions[0].dataActions[0]', + 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*'), + self.check('permissions[0].notDataActions[0]', + 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'), + ]).get_output_in_json() + self.kwargs['name'] = role['name'] + retry(lambda: self.cmd('role definition show --scope {scope} --name {name}', + checks=self.check('[0].roleName', '{role}'))).get_output_in_json() + retry(lambda: self.cmd('role definition delete -n {name}', checks=self.is_empty())) + retry(lambda: self.cmd('role definition show -n {name}', checks=self.is_empty())) + + # Operate on roleName self.cmd('role definition create --role-definition {template}', checks=[ self.check('permissions[0].dataActions[0]', 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*'), self.check('permissions[0].notDataActions[0]', 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'),