From 5ded81d33911bb986a20656ae854a7d36c20225d Mon Sep 17 00:00:00 2001 From: jiasli <4003950+jiasli@users.noreply.github.com> Date: Mon, 13 Jan 2025 18:46:59 +0800 Subject: [PATCH 1/3] role-definition-delete --- src/azure-cli/azure/cli/command_modules/role/custom.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/azure-cli/azure/cli/command_modules/role/custom.py b/src/azure-cli/azure/cli/command_modules/role/custom.py index f7731268fe7..9f9b751fc54 100644 --- a/src/azure-cli/azure/cli/command_modules/role/custom.py +++ b/src/azure-cli/azure/cli/command_modules/role/custom.py @@ -134,6 +134,9 @@ def delete_role_definition(cmd, name, resource_group_name=None, scope=None, definitions_client = _auth_client_factory(cmd.cli_ctx, scope).role_definitions scope = _build_role_scope(resource_group_name, scope, definitions_client._config.subscription_id) + if is_guid(name): + definitions_client.delete(scope, name) + return roles = _search_role_definitions(cmd.cli_ctx, definitions_client, name, [scope], custom_role_only) for r in roles: definitions_client.delete(role_definition_id=r.name, scope=scope) From 6706f1dbb6cfcbc52c4e7240f553c94f9e83155a Mon Sep 17 00:00:00 2001 From: jiasli <4003950+jiasli@users.noreply.github.com> Date: Tue, 14 Jan 2025 17:46:21 +0800 Subject: [PATCH 2/3] add help --- src/azure-cli/azure/cli/command_modules/role/_help.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/azure-cli/azure/cli/command_modules/role/_help.py b/src/azure-cli/azure/cli/command_modules/role/_help.py index a21fa63e1d8..4d8bae3f1fb 100644 --- a/src/azure-cli/azure/cli/command_modules/role/_help.py +++ b/src/azure-cli/azure/cli/command_modules/role/_help.py @@ -854,9 +854,10 @@ type: command short-summary: Delete a role definition. examples: - - name: Delete a role definition. (autogenerated) - text: az role definition delete --name MyRole - crafted: true + - name: Delete a role definition by roleName. + text: az role definition delete --scope /subscriptions/00000000-0000-0000-0000-000000000000 --name MyRole + - name: Delete a role definition by name (GUID). + text: az role definition delete --scope /subscriptions/00000000-0000-0000-0000-000000000000 --name 00000000-0000-0000-0000-000000000000 """ helps['role definition list'] = """ From 586f286de1b7349acecc0aac8e376579e1b70a0e Mon Sep 17 00:00:00 2001 From: jiasli <4003950+jiasli@users.noreply.github.com> Date: Tue, 14 Jan 2025 17:59:16 +0800 Subject: [PATCH 3/3] add test --- .../role/tests/latest/test_role.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py b/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py index 2b295151c9c..e18f458be20 100644 --- a/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py +++ b/src/azure-cli/azure/cli/command_modules/role/tests/latest/test_role.py @@ -248,11 +248,26 @@ def test_custom_role_definition_scenario(self): self.kwargs.update({ 'sub': subscription_id, 'role': role_name, - 'template': temp_file.replace('\\', '\\\\') + 'template': temp_file.replace('\\', '\\\\'), + 'scope': "/subscriptions/{}".format(subscription_id) }) # a few 'sleep' here to handle server replicate latency. It is no-op under playback with mock.patch('azure.cli.command_modules.role.custom._gen_guid', side_effect=self.create_guid): + # Operate on name (GUID) + role = self.cmd('role definition create --role-definition {template}', checks=[ + self.check('permissions[0].dataActions[0]', + 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*'), + self.check('permissions[0].notDataActions[0]', + 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'), + ]).get_output_in_json() + self.kwargs['name'] = role['name'] + retry(lambda: self.cmd('role definition show --scope {scope} --name {name}', + checks=self.check('[0].roleName', '{role}'))).get_output_in_json() + retry(lambda: self.cmd('role definition delete -n {name}', checks=self.is_empty())) + retry(lambda: self.cmd('role definition show -n {name}', checks=self.is_empty())) + + # Operate on roleName self.cmd('role definition create --role-definition {template}', checks=[ self.check('permissions[0].dataActions[0]', 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*'), self.check('permissions[0].notDataActions[0]', 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'),