[Role] az role assignment create/update: Support `--description`, `--condition` and `--condition-version` by jiasli · Pull Request #14958 · Azure/azure-cli

jiasli · 2020-08-28T08:40:22Z

`az role assignment create`

Design

New arguments to add to the existing arguments:

Arguments
    --description             : Description of the role assignment.
    --condition               : Condition under which the user can be granted permission
    --condition-version       : Version of the condition syntax

Examples

# line breaks for legibility
az role assignment create --assignee admin4@AzureSDKTeam.onmicrosoft.com
                          --role reader
                          --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1
                          --description "Role assignment foo to check on bar"
                          --condition "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'"
                          --condition-version "2.0"

Sample Output:

{
  "canDelegate": null,
  "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'",
  "conditionVersion": "2.0",
  "description": "Role assignment foo to check on bar",
  "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1/providers/Microsoft.Authorization/roleAssignments/d89f022c-f12f-4fb5-9d90-afb9c1f4fd83",
  "name": "d89f022c-f12f-4fb5-9d90-afb9c1f4fd83",
  "principalId": "182c8534-f413-487c-91a3-7addc80e35d5",
  "principalType": "User",
  "resourceGroup": "rg1",
  "roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1",
  "type": "Microsoft.Authorization/roleAssignments"
}

Checks

Description

description is a string.
If description is empty, replace with null.

Condition

condition is a string.
If condition is empty replace with null.

Condition-Version

condition-version is a string.
condition-version must be > 1.0.
- The service already has this check: The specified role assignment ConditionVersion '0.1' is not supported.
If condition-version is empty and condition is set, condition-version defaults to 2.0.
If condition-version is set, condition must be set as well.

`az role assignment update`

Design

Command
    az role assignment update : update an existing role assignment for a user, group, or service
    principal.

Arguments
    --role-assignment   [Required] :  Description of a role as JSON, or a path to a file containing a JSON description.

Example

az role assignment update --role-assignment '{
  "canDelegate": null,
  "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals '"'"'foo'"'"'",
  "conditionVersion": "2.0",
  "description": "Role assignment foo to check on bar",
  "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1/providers/Microsoft.Authorization/roleAssignments/d89f022c-f12f-4fb5-9d90-afb9c1f4fd83",
  "name": "d89f022c-f12f-4fb5-9d90-afb9c1f4fd83",
  "principalId": "182c8534-f413-487c-91a3-7addc80e35d5",
  "principalType": "User",
  "resourceGroup": "rg1",
  "roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1",
  "type": "Microsoft.Authorization/roleAssignments"
}'

# or
az role assignment update --role-assignment "C:\Path\to\JSON\roleAssignment.json

Sample Output:

{
  "canDelegate": null,
  "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'",
  "conditionVersion": "2.0",
  "description": "Role assignment foo to check on bar",
  "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1/providers/Microsoft.Authorization/roleAssignments/d89f022c-f12f-4fb5-9d90-afb9c1f4fd83",
  "name": "d89f022c-f12f-4fb5-9d90-afb9c1f4fd83",
  "principalId": "182c8534-f413-487c-91a3-7addc80e35d5",
  "principalType": "User",
  "resourceGroup": "rg1",
  "roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1",
  "type": "Microsoft.Authorization/roleAssignments"
}

Checks

Same as for role assignment create with some small exceptions/additions:

Only description, condition and conditionVersion can be modified.
- This requires lots of efforts for diffing the original REST response and user input and should be implemented on the service side. NOT IMPLEMENTED in CLI yet.
if no role assignment exists with the indicated properties, throw an exception indicating as such.
conditionVersion cannot be downgraded to 1.X.

Testing Guide

az group create -l westus -n rg1

az role assignment create --assignee admin4@AzureSDKTeam.onmicrosoft.com --role reader --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1 --description "Role assignment foo to check on bar" --condition "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'" --condition-version "2.0"

az role assignment update --role-assignment '{
  "canDelegate": null,
  "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals '"'"'foo'"'"'",
  "conditionVersion": "2.0",
  "description": "Role assignment foo to check on bar",
  "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1/providers/Microsoft.Authorization/roleAssignments/9e8947f9-a813-4003-bbdd-98fa57d4dca0",
  "name": "9e8947f9-a813-4003-bbdd-98fa57d4dca0",
  "principalId": "182c8534-f413-487c-91a3-7addc80e35d5",
  "principalName": "admin4@AzureSDKTeam.onmicrosoft.com",
  "principalType": "User",
  "resourceGroup": "rg1",
  "roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "roleDefinitionName": "Reader",
  "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1",
  "type": "Microsoft.Authorization/roleAssignments"
}'

az role assignment delete -g rg1

az role assignment create --assignee admin4@AzureSDKTeam.onmicrosoft.com --role reader --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1 --description "Role assignment foo to check on bar" --condition "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:Name] stringEquals 'foo'" --condition-version "2.0" > output.json

az role assignment update --role-assignment output.json

az group delete -n rg1

jiasli · 2020-08-28T08:43:13Z

This PR should be merged after #14461 and #14317 are merged.

yonzhan · 2020-08-28T09:49:13Z

Role

qwordy · 2020-09-10T07:56:08Z

src/azure-cli/azure/cli/command_modules/role/_help.py

Can we add parameters like --can-deleagate so that users can see help messages.

Taking JSON as an input is asked by the service team. I had the same suggestion as you to expose explicit arguments but the suggestion was rejected.

CLI is yours. You fix it. Be brave. Go ahead.

qwordy · 2020-09-14T01:50:43Z

src/azure-cli/azure/cli/command_modules/role/_help.py

  - name: Create role assignment for an assignee.
    text: az role assignment create --assignee sp_name --role a_role
+  - name: Create role assignment for an assignee with description and condition. (Only for 2020-04-01-preview API version and later.)
+    text: >-


What's the difference between >- and |?

@qwordy

In short: >- will replace all single \n to whitespace (especially, the final \n will be removed), and combine double \n to one.

I use >- to make the code more readable purposefully.

src/azure-cli/azure/cli/command_modules/role/custom.py

bim-msft · 2020-09-14T07:54:58Z

src/azure-cli/azure/cli/command_modules/role/_help.py

  - name: Create role assignment for an assignee.
    text: az role assignment create --assignee sp_name --role a_role
+  - name: Create role assignment for an assignee with description and condition. (Only for 2020-04-01-preview API version and later.)
+    text: >-


@qwordy

In short: >- will replace all single \n to whitespace (especially, the final \n will be removed), and combine double \n to one.

jiasli · 2020-09-15T03:44:54Z

src/azure-cli/azure/cli/command_modules/role/_params.py

        c.argument('include_classic_administrators', arg_type=get_three_state_flag(), help='list default role assignments for subscription classic administrators, aka co-admins')
+        c.argument('description', min_api='2020-04-01-preview', help='Description of role assignment.')
+        c.argument('condition', min_api='2020-04-01-preview', help='Condition under which the user can be granted permission.')
+        c.argument('condition_version', min_api='2020-04-01-preview', help='Version of the condition syntax. If --condition is specified without --condition-version, default to 2.0.')


How about adding this default value in the help message ?

Added. I didn't use the built-in default mechanism because it is a conditional default - only when --condition is specified.

jsntcy

jiasli requested review from Juliehzl, arrownj, bim-msft, fengzhou-msft, haroldrandom, jsntcy and mmyyrroonn as code owners August 28, 2020 08:40

This was referenced Aug 28, 2020

{Role} Fix: az role assignment list-changelogs fails with KeyError #14461

Merged

{Role} Bump ResourceType.MGMT_AUTHORIZATION to 2020-04-01-preview #14317

Merged

yonzhan assigned jiasli Aug 28, 2020

yonzhan added this to the S175 - For Ignite milestone Aug 28, 2020

jiasli requested review from qwordy and zhoxing-ms as code owners September 8, 2020 07:59

jiasli force-pushed the role-assignment branch from f1c46d1 to 4d7e6aa Compare September 8, 2020 08:05

qwordy reviewed Sep 10, 2020

View reviewed changes

Support --description, --condition and --condition-version

2776a5f

jiasli force-pushed the role-assignment branch from 323363e to 2776a5f Compare September 11, 2020 03:28

style

f3f2fcb

qwordy reviewed Sep 14, 2020

View reviewed changes

qwordy approved these changes Sep 14, 2020

View reviewed changes

arrownj reviewed Sep 14, 2020

View reviewed changes

src/azure-cli/azure/cli/command_modules/role/custom.py Show resolved Hide resolved

bim-msft approved these changes Sep 14, 2020

View reviewed changes

Update param help

ca2cb21

jiasli commented Sep 15, 2020

View reviewed changes

jsntcy approved these changes Sep 15, 2020

View reviewed changes

arrownj approved these changes Sep 15, 2020

View reviewed changes

Add supported-profiles: latest

2f61b65

jiasli merged commit 5f40c5e into Azure:dev Sep 15, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Role] az role assignment create/update: Support `--description`, `--condition` and `--condition-version`#14958

[Role] az role assignment create/update: Support `--description`, `--condition` and `--condition-version`#14958
jiasli merged 4 commits intoAzure:devfrom
jiasli:role-assignment

jiasli commented Aug 28, 2020

Uh oh!

jiasli commented Aug 28, 2020 •

edited

Loading

Uh oh!

yonzhan commented Aug 28, 2020

Uh oh!

qwordy Sep 10, 2020

Uh oh!

jiasli Sep 11, 2020

Uh oh!

qwordy Sep 14, 2020

Uh oh!

qwordy Sep 14, 2020

Uh oh!

bim-msft Sep 14, 2020 •

edited

Loading

Uh oh!

jiasli Sep 15, 2020

Uh oh!

Uh oh!

bim-msft Sep 14, 2020 •

edited

Loading

Uh oh!

jiasli Sep 15, 2020 •

edited

Loading

Uh oh!

jsntcy left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

jiasli commented Aug 28, 2020

az role assignment create

Design

Examples

Checks

Description

Condition

Condition-Version

az role assignment update

Design

Example

Checks

Testing Guide

Uh oh!

jiasli commented Aug 28, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonzhan commented Aug 28, 2020

Uh oh!

qwordy Sep 10, 2020

Choose a reason for hiding this comment

Uh oh!

jiasli Sep 11, 2020

Choose a reason for hiding this comment

Uh oh!

qwordy Sep 14, 2020

Choose a reason for hiding this comment

Uh oh!

qwordy Sep 14, 2020

Choose a reason for hiding this comment

Uh oh!

bim-msft Sep 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jiasli Sep 15, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bim-msft Sep 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jiasli Sep 15, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsntcy left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

`az role assignment create`

`az role assignment update`

jiasli commented Aug 28, 2020 •

edited

Loading

bim-msft Sep 14, 2020 •

edited

Loading

bim-msft Sep 14, 2020 •

edited

Loading

jiasli Sep 15, 2020 •

edited

Loading