Storage file share resource manager ID is incorrect

[magodo]

The resource manager ID of a storage file share is defined as below (link):

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/fileServices/default/shares/{shareName}

While when assigning a role to the file share resource via Portal/CLI, it uses the following format:

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/fileServices/default/fileshares/{shareName}

The difference is that the last segment is named shares vs fileshares.

• Portal:

• CLI:

  #Assign the built-in role to the target identity: Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, Storage File Data SMB Share Elevated Contributor
  az role assignment create --role "<role-name>" --assignee <user-principal-name> --scope 
  "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/fileServices/default/fileshares/<share-name>"
  

  See: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-cli#share-level-permissions-for-specific-azure-ad-users-or-groups

Using the ID format that is defined in the spec (i.e. ending with shares) won't work, at least for Azure RBAC.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

Issue Details

---

The resource manager ID of a storage file share is defined as below (link):

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/fileServices/default/shares/{shareName}

While when assigning a role to the file share resource via Portal/CLI, it uses the following format:

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/fileServices/default/fileshares/{shareName}

The difference is that the last segment is named shares vs fileshares.

• Portal:

• CLI:

  #Assign the built-in role to the target identity: Storage File Data SMB Share Reader, Storage File Data SMB Share Contributor, Storage File Data SMB Share Elevated Contributor
  az role assignment create --role "<role-name>" --assignee <user-principal-name> --scope 
  "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/fileServices/default/fileshares/<share-name>"
  

  See: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-cli#share-level-permissions-for-specific-azure-ad-users-or-groups

Using the ID format that is defined in the spec (i.e. ending with shares) won't work, at least for Azure RBAC.

Author:	magodo
Assignees:	-
Labels:	Storage, Service Attention, needs-triage
Milestone:	-

[magodo]

ping @JackTn

[gstephenhr]

hitting this December 2024

Azure/bicep-types-az#1532