Skip to content

chore: Update RBAC Configuration to Reference Role IDs (follow-up) #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ShreyasW-Microsoft wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

chore: Update RBAC Configuration to Reference Role IDs (follow-up) #308

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7f122a1
use role ids instead of role names
Shreyas-Microsoft Jun 19, 2026
2a9f3fb
chore: reference App Configuration Data Reader role by ID
ShreyasW-Microsoft Jun 29, 2026
739976b
style: use '// Role Name' inline comment format for role IDs
ShreyasW-Microsoft Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions infra/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -634,23 +634,23 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
supportsHttpsTrafficOnly: true
roleAssignments: [
{
roleDefinitionIdOrName: 'Storage Blob Data Contributor'
roleDefinitionIdOrName: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' //'Storage Blob Data Contributor'
Comment thread
Copilot marked this conversation as resolved.
Outdated
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
}
{
roleDefinitionIdOrName: 'Storage Queue Data Contributor'
roleDefinitionIdOrName: '974c5e8b-45b9-4653-ba55-5f855dd0fb88' //'Storage Queue Data Contributor'
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
}
// Add deployer permissions
{
roleDefinitionIdOrName: 'Storage Blob Data Contributor'
roleDefinitionIdOrName: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' //'Storage Blob Data Contributor'
principalId: deployingUserPrincipalId
principalType: deployingUserType
}
{
roleDefinitionIdOrName: 'Storage Queue Data Contributor'
roleDefinitionIdOrName: '974c5e8b-45b9-4653-ba55-5f855dd0fb88' //'Storage Queue Data Contributor'
principalId: deployingUserPrincipalId
principalType: deployingUserType
}
Expand Down Expand Up @@ -847,13 +847,13 @@ module cosmosDb 'br/public:avm/res/document-db/database-account:0.15.0' = {
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: 'DocumentDB Account Contributor'
roleDefinitionIdOrName: '5bd9cd88-fe45-4216-938b-f97437e15450' //'DocumentDB Account Contributor'
}
// Add deployer for local debugging
{
principalId: deployingUserPrincipalId
principalType: deployingUserType
roleDefinitionIdOrName: 'DocumentDB Account Contributor'
roleDefinitionIdOrName: '5bd9cd88-fe45-4216-938b-f97437e15450' //'DocumentDB Account Contributor'
}
]
// Create custom data plane role definition and assignment
Expand Down Expand Up @@ -935,28 +935,28 @@ module existingAiFoundryAiServicesDeployments 'modules/ai-services-deployments.b
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
}
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: '64702f94-c441-49e6-a78b-ef80e0188fee'
roleDefinitionIdOrName: '64702f94-c441-49e6-a78b-ef80e0188fee' //'Azure AI Developer'
}
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d'
roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' //'Foundry User'
}
// Deployer permissions
{
principalId: deployingUserPrincipalId
principalType: deployingUserType
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
}
{
principalId: deployingUserPrincipalId
principalType: deployingUserType
roleDefinitionIdOrName: 'Cognitive Services User'
roleDefinitionIdOrName: 'a97b65f3-24c7-4388-baec-2e87135dc908' //'Cognitive Services User'
}
]
}
Expand Down Expand Up @@ -1012,7 +1012,7 @@ module aiFoundryAiServices 'br/public:avm/res/cognitive-services/account:0.13.2'
roleAssignments: [
// Service Principal permissions
{
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
}
Expand All @@ -1028,12 +1028,12 @@ module aiFoundryAiServices 'br/public:avm/res/cognitive-services/account:0.13.2'
}
// Deployer permissions for local debugging
{
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
principalId: deployingUserPrincipalId
principalType: deployingUserType
}
{
roleDefinitionIdOrName: 'Cognitive Services User'
roleDefinitionIdOrName: 'a97b65f3-24c7-4388-baec-2e87135dc908' //'Cognitive Services User'
principalId: deployingUserPrincipalId
principalType: deployingUserType
}
Expand Down Expand Up @@ -1215,7 +1215,7 @@ module appConfiguration 'br/public:avm/res/app-configuration/configuration-store
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: 'App Configuration Data Reader'
roleDefinitionIdOrName: '516239f1-63e1-4d78-a4de-a74fb236a071' //'App Configuration Data Reader'
Comment thread
Copilot marked this conversation as resolved.
Outdated
}
]
enableTelemetry: enableTelemetry
Expand Down
46 changes: 23 additions & 23 deletions infra/main.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.43.8.12551",
"templateHash": "2561563027340256551"
"version": "0.44.1.10279",
"templateHash": "8615995649961363295"
}
},
"parameters": {
Expand Down Expand Up @@ -4717,8 +4717,8 @@
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.43.8.12551",
"templateHash": "4604761290796021104"
"version": "0.44.1.10279",
"templateHash": "8338582776365718527"
}
},
"definitions": {
Expand Down Expand Up @@ -21723,22 +21723,22 @@
"roleAssignments": {
"value": [
{
"roleDefinitionIdOrName": "Storage Blob Data Contributor",
"roleDefinitionIdOrName": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
"principalId": "[reference('appIdentity').outputs.principalId.value]",
"principalType": "ServicePrincipal"
},
{
"roleDefinitionIdOrName": "Storage Queue Data Contributor",
"roleDefinitionIdOrName": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
"principalId": "[reference('appIdentity').outputs.principalId.value]",
"principalType": "ServicePrincipal"
},
{
"roleDefinitionIdOrName": "Storage Blob Data Contributor",
"roleDefinitionIdOrName": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]"
},
{
"roleDefinitionIdOrName": "Storage Queue Data Contributor",
"roleDefinitionIdOrName": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]"
}
Expand Down Expand Up @@ -27476,8 +27476,8 @@
},
"dependsOn": [
"appIdentity",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageQueue)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
"virtualNetwork"
]
},
Expand Down Expand Up @@ -27564,12 +27564,12 @@
{
"principalId": "[reference('appIdentity').outputs.principalId.value]",
"principalType": "ServicePrincipal",
"roleDefinitionIdOrName": "DocumentDB Account Contributor"
"roleDefinitionIdOrName": "5bd9cd88-fe45-4216-938b-f97437e15450"
},
{
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]",
"roleDefinitionIdOrName": "DocumentDB Account Contributor"
"roleDefinitionIdOrName": "5bd9cd88-fe45-4216-938b-f97437e15450"
}
]
},
Expand Down Expand Up @@ -31417,7 +31417,7 @@
{
"principalId": "[reference('appIdentity').outputs.principalId.value]",
"principalType": "ServicePrincipal",
"roleDefinitionIdOrName": "Cognitive Services OpenAI Contributor"
"roleDefinitionIdOrName": "a001fd3d-188f-4b5d-821b-7da978bf7442"
},
{
"principalId": "[reference('appIdentity').outputs.principalId.value]",
Expand All @@ -31432,12 +31432,12 @@
{
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]",
"roleDefinitionIdOrName": "Cognitive Services OpenAI Contributor"
"roleDefinitionIdOrName": "a001fd3d-188f-4b5d-821b-7da978bf7442"
},
{
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]",
"roleDefinitionIdOrName": "Cognitive Services User"
"roleDefinitionIdOrName": "a97b65f3-24c7-4388-baec-2e87135dc908"
}
]
}
Expand All @@ -31449,8 +31449,8 @@
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.43.8.12551",
"templateHash": "13516349791985095953"
"version": "0.44.1.10279",
"templateHash": "8388310902652207735"
}
},
"definitions": {
Expand Down Expand Up @@ -31855,7 +31855,7 @@
"roleAssignments": {
"value": [
{
"roleDefinitionIdOrName": "Cognitive Services OpenAI Contributor",
"roleDefinitionIdOrName": "a001fd3d-188f-4b5d-821b-7da978bf7442",
"principalId": "[reference('appIdentity').outputs.principalId.value]",
"principalType": "ServicePrincipal"
},
Expand All @@ -31870,12 +31870,12 @@
"principalType": "ServicePrincipal"
},
{
"roleDefinitionIdOrName": "Cognitive Services OpenAI Contributor",
"roleDefinitionIdOrName": "a001fd3d-188f-4b5d-821b-7da978bf7442",
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]"
},
{
"roleDefinitionIdOrName": "Cognitive Services User",
"roleDefinitionIdOrName": "a97b65f3-24c7-4388-baec-2e87135dc908",
"principalId": "[variables('deployingUserPrincipalId')]",
"principalType": "[variables('deployingUserType')]"
}
Expand Down Expand Up @@ -35199,9 +35199,9 @@
},
"dependsOn": [
"aiFoundryAiServices",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
"virtualNetwork"
]
},
Expand Down Expand Up @@ -35238,8 +35238,8 @@
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.43.8.12551",
"templateHash": "17583277036649944863"
"version": "0.44.1.10279",
"templateHash": "16726486764770261194"
}
},
"parameters": {
Expand Down Expand Up @@ -35461,7 +35461,7 @@
{
"principalId": "[reference('appIdentity').outputs.principalId.value]",
"principalType": "ServicePrincipal",
"roleDefinitionIdOrName": "App Configuration Data Reader"
"roleDefinitionIdOrName": "516239f1-63e1-4d78-a4de-a74fb236a071"
}
]
},
Expand Down
16 changes: 8 additions & 8 deletions infra/main_custom.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -612,12 +612,12 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
supportsHttpsTrafficOnly: true
roleAssignments: [
{
roleDefinitionIdOrName: 'Storage Blob Data Contributor'
roleDefinitionIdOrName: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' //'Storage Blob Data Contributor'
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
}
{
roleDefinitionIdOrName: 'Storage Queue Data Contributor'
roleDefinitionIdOrName: '974c5e8b-45b9-4653-ba55-5f855dd0fb88' //'Storage Queue Data Contributor'
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
}
Expand Down Expand Up @@ -806,7 +806,7 @@ module cosmosDb 'br/public:avm/res/document-db/database-account:0.15.0' = {
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: 'DocumentDB Account Contributor'
roleDefinitionIdOrName: '5bd9cd88-fe45-4216-938b-f97437e15450' //'DocumentDB Account Contributor'
}
]
// Create custom data plane role definition and assignment
Expand Down Expand Up @@ -902,7 +902,7 @@ module existingAiFoundryAiServicesDeployments 'modules/ai-services-deployments.b
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
}
{
principalId: appIdentity.outputs.principalId
Expand Down Expand Up @@ -956,7 +956,7 @@ module aiFoundryAiServices 'br/public:avm/res/cognitive-services/account:0.13.2'
roleAssignments: [
// Service Principal permissions
{
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
}
Expand All @@ -972,12 +972,12 @@ module aiFoundryAiServices 'br/public:avm/res/cognitive-services/account:0.13.2'
}
// Deployer permissions for local debugging
{
roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
roleDefinitionIdOrName: 'a001fd3d-188f-4b5d-821b-7da978bf7442' //'Cognitive Services OpenAI Contributor'
principalId: deployingUserPrincipalId
principalType: 'User'
}
{
roleDefinitionIdOrName: 'Cognitive Services User'
roleDefinitionIdOrName: 'a97b65f3-24c7-4388-baec-2e87135dc908' //'Cognitive Services User'
principalId: deployingUserPrincipalId
principalType: 'User'
}
Expand Down Expand Up @@ -1172,7 +1172,7 @@ module appConfiguration 'br/public:avm/res/app-configuration/configuration-store
{
principalId: appIdentity.outputs.principalId
principalType: 'ServicePrincipal'
roleDefinitionIdOrName: 'App Configuration Data Reader'
roleDefinitionIdOrName: '516239f1-63e1-4d78-a4de-a74fb236a071' //'App Configuration Data Reader'
}
]
enableTelemetry: enableTelemetry
Expand Down