SMB File Share Role Assignment Failing: modules/storage/storage-account/file-service/share

[DanGiffen]

Describe the bug

Deployment of a new SMB file share to an existing storage account completes successfully. The deployment in the resource group reports succeeded including the share role assignment operation too however no IAM\Role assignment is implemented.

To reproduce

Create a template to deploy a new SMB file share to an existing storage account. Pass role assignment array properties in with a parameter file

Code snippet

module storageAccount1Share '../../bicep/carml0.11.0/storage/storage-account/file-service/share/main.bicep' = if(deployStorageAccount1Share) {
  scope: resourceGroup(resourceGroupStorageAccount1Name)
  name: '${uniqueString(deployment().name, location)}-deploy-sa1-share'
  params: {
    name: storageAccount1ShareName
    storageAccountName: existingStorageAccount1Name
    fileServicesName: fileServicesName
    accessTier: accessTier
    roleAssignments: storageAccount1ShareRoleAssignments
    enableDefaultTelemetry: enableDefaultTelemetry
  }
}

    "storageAccount1ShareRoleAssignments": {
      "value": [
        {
          "roleDefinitionIdOrName": "Storage File Data SMB Share Contributor",
          "description": "Storage File Data SMB Share Contributor Allows for read, write, and delete access in Azure Storage file shares over SMB",
          "principalId": "123-456-789-abcdef-ghijklmnopqrstuvwxyz"
        },
        {
          "roleDefinitionIdOrName": "Storage File Data SMB Share Contributor",
          "description": "Storage File Data SMB Share Contributor Allows for read, write, and delete access in Azure Storage file shares over SMB",
          "principalId": "123-456-789-abcdef-ghijklmnopqrstuvwxyz"
        }
      ]
    }

Relevant log output

No response

[AlexanderSehr]

Hey @DanGiffen,
thanks for raising this and sorry for not coming around sooner. I'll look into this as soon as I can, but likely not before mid next week.

[DanGiffen]

No problem and thanks @AlexanderSehr

[AlexanderSehr]

Hey @DanGiffen,

I'm still looking into this but it's a curious case in which this is what the dpeloyment ID is
/subscriptions/.../resourceGroups/alsehr-sa-role-test-rg/providers/Microsoft.Storage/storageAccounts/.../fileServices/default/shares/automatedshare/providers/Microsoft.Authorization/roleAssignments/8245c551-44fc-5777-83b0-f14b16a2e6a9

and this is what the id is when deployed via the portal (fetching the REST payload)
/subscriptions/.../resourceGroups/alsehr-sa-role-test-rg/providers/Microsoft.Storage/storageAccounts/.../fileServices/default/fileshares/automatedshare/providers/Microsoft.Authorization/roleAssignments/20dcf0a3-fc5f-4fae-bd58-951a2b6a693e?api-version=2020-04-01-preview

The most notable difference: In the first case its

• fileServices/default/shares while in the second it's
• fileServices/default/fileShares.

However, a resource provider called 'fileShares` doens't actually exist (as you can also see here). Not quite sure what to make of it right now, but I'll keep looking.

[AlexanderSehr]

Soo... yeah ... I did some research and found this little nugget of an issue: Azure/bicep-types-az#1532

Turns out, it's a provider bug. There is a workaround suggested that essentially forces a deployment object into the Bicep template, mimicing ARM, but it's not great. I'll go ahead and implement that and try to reach out to the Product Group too.

[DanGiffen]

Ah ok thanks Alexander, hopefully the product group can plug that gap. Cheers Dan

…

On Wed, 20 Dec 2023, 20:20 Alexander Sehr, ***@***.***> wrote: Soo... yeah ... I did some research and found this little nugget of an issue: Azure/bicep-types-az#1532 <Azure/bicep-types-az#1532> Turns out, it's a provider bug. There is a workaround suggested that essentially forces a deployment object into the Bicep template, mimicing ARM, but it's not great. I'll go ahead and implement that and try to reach out to the Product Group too. — Reply to this email directly, view it on GitHub <#4346 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJF74RJXPDLKUVTHWVHUGP3YKNCA3AVCNFSM6AAAAABAH2JEQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNRVGA4DEMBRGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[AlexanderSehr]

Trying to get a response already 😊