role assignment on postgres for a managed identity (azure vm)

[SabapathyKannappan]

Hello,

I am trying to assign inbuilt role (Reader) for a system assigned identity (azure VM) on a Azure postgres database.

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-10-01-preview' = {
scope: existingPostgresResource
name: guid(existingPostgresResource.id, roleDefinitionId, resourceGroup().id)
properties: {
roleDefinitionId: roleDefinitionId
principalId: principalId
principalType: principalType
}
}

the principal ID in the above is retrieved in the main template as:
principalId: reference(resourceId(resgrpname, 'Microsoft.DBforPostgreSQL/servers', existingPostgresResource.name), '2017-12-01', 'Full').identity.principalId

Note: In the postgres deployment, we have ensured that :

identity: {
type: 'SystemAssigned'
}

is set.

Result: When deploying the bicep module, we face this error:

"code": "BadRequestFormat",
"message": "The request was incorrectly formatted."

Any hints on how to assign roles using bicep on a postgres for a managed VM?

Regards,

Saba

[brwilkinson]

What format are you using for the roleDefinitionId?

E.g.

resourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))

[SabapathyKannappan]

Hi,

Thanks for your reply.. this is the excerpt

module roleassignmentforvmonpostgres './roleassignmentonpostgres.bicep' = {
name: 'roleassignmentforvmonpostgres'
//scope: resourceGroup(vmresourceGroupName)
params: {
azureResource: dbenterprisename
principalType: principalType
//Get the principal ID of the system assigned identity
principalId: reference(resourceId(resgrpname, 'Microsoft.DBforPostgreSQL/servers', existingPostgresResource.name), '2017-12-01', 'Full').identity.principalId
//principalId:
roleDefinitionId: readerUserRole
}
}

is this what you expected?

[SabapathyKannappan]

var readerUserRole = 'acdd72a7-3385-48ef-bd42-f606fba81ae7' //Reader - View all resources, but does not allow you to make any changes.

[brwilkinson]

Can you try with the full reference to the roleid, you can use the code I showed above.

[SabapathyKannappan]

Will try and get back .. thanks for the hint

[SabapathyKannappan]

It works.. my mistake.. the full reference ID did it. Thanks a lot.