4

I try to create two role definitions and two role assignments to one Azure CosmosDB SQL API account using Bicep template.

I decompiled below arm template with az bicep decompile: https://github.com/Azure/azure-quickstart-templates/blob/master/101-cosmosdb-sql-rbac/azuredeploy.json

and I got below:

resource accountName_readOnlyRoleDefinitionId 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2020-06-01-preview' = {
  parent: accountName_resource
  name: '${readOnlyRoleDefinitionId}'
  properties: {
    roleName: readOnlyRoleDefinitionName
    type: 'CustomRole'
    assignableScopes: [
      accountName_resource.id
    ]
    permissions: [
      {
        dataActions: readOnlyRoleDataActions
      }
    ]
  }
}

resource accountName_readOnlyRoleAssignmentId 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2020-06-01-preview' = {
  parent: accountName_resource
  name: '${readOnlyRoleAssignmentId}'
  properties: {
    roleDefinitionId: accountName_readOnlyRoleDefinitionId.id
    principalId: readOnlyPrincipalId
    scope: accountName_resource.id
  }
}

which works, but only when I have one role definition and assignment.

When I try deploy it together with below:

resource accountName_readWriteRoleDefinitionId 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2020-06-01-preview' = {
  parent: accountName_resource
  name: '${readWriteRoleDefinitionId}'
  properties: {
    roleName: readWriteRoleDefinitionName
    type: 'CustomRole'
    assignableScopes: [
      accountName_resource.id
    ]
    permissions: [
      {
        dataActions: readWriteRoleDataActions
      }
    ]
  }
}

resource accountName_readWriteRoleAssignmentId 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2020-06-01-preview' = {
  parent: accountName_resource
  name: '${readWriteRoleAssignmentId}'
  properties: {
    roleDefinitionId: accountName_readWriteRoleDefinitionId.id
    principalId: readWritePrincipalId
    scope: accountName_resource.id
  }
}

I have got below error:

Deployment failed. Correlation ID: 8fe92bd6-6db6-4d9a-98b5-5f78811cc741. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "DeploymentFailed",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
        "details": [
          {
            "code": "PreconditionFailed",
            "message": "{\r\n  \"code\": \"PreconditionFailed\",\r\n  \"message\": \"There is another user operation in progress which requires an exclusive lock on [cosmossqlapibiceptest]. Please retry after sometime.\\r\\nActivityId: 7d56ef38-85ee-490e-9819-cc74afc142d3, Microsoft.Azure.Documents.Common/2.14.0\"\r\n}"
          }
        ]
      }
    ]
  }
}

I tried also iterating instead of having separated resources, using nested modules for each role, but it does not help.

UPDATE 2021-06-02

I tried also deployed json file, but result the same. I attached arm template:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.3.539.46024",
      "templateHash": "54838909324108202"
    }
  },
  "functions": [],
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "name": "cosmos_deployment",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "accountName": {
            "value": "add_yours_input"
          },
          "databaseName": {
            "value": "add_yours_input"
          },
          "containerName": {
            "value": "add_yours_input"
          },
          "timeToLive": {
            "value": 2592000
          },
          "readOnlyPrincipalId": {
            "value": "add_yours_input"
          },
          "readWritePrincipalId": {
            "value": "add_yours_input"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.3.539.46024",
              "templateHash": "10083279953983831862"
            }
          },
          "parameters": {
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]"
            },
            "accountName": {
              "type": "string"
            },
            "databaseName": {
              "type": "string"
            },
            "containerName": {
              "type": "string"
            },
            "timeToLive": {
              "type": "int"
            },
            "throughput": {
              "type": "int",
              "defaultValue": 400,
              "metadata": {
                "description": "The throughput for the container"
              },
              "maxValue": 1000000,
              "minValue": 400
            },
            "publicNetworkAccess": {
              "type": "string",
              "defaultValue": "Enabled",
              "allowedValues": [
                "Enabled",
                "Disabled"
              ]
            },
            "readOnlyPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "Object ID of the AAD identity. Must be a GUID."
              }
            },
            "readOnlyRoleDefinitionName": {
              "type": "string",
              "defaultValue": "Read Only Role"
            },
            "readOnlyRoleDataActions": {
              "type": "array",
              "defaultValue": [
                "Microsoft.DocumentDB/databaseAccounts/readMetadata",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/readChangeFeed"
              ],
              "metadata": {
                "description": "Data actions permitted by the ReadOnlyRole Role Definition"
              }
            },
            "readWritePrincipalId": {
              "type": "string",
              "metadata": {
                "description": "Object ID of the AAD identity. Must be a GUID."
              }
            },
            "readWriteRoleDefinitionName": {
              "type": "string",
              "defaultValue": "Read Write Role"
            },
            "readWriteRoleDataActions": {
              "type": "array",
              "defaultValue": [
                "Microsoft.DocumentDB/databaseAccounts/readMetadata",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*"
              ],
              "metadata": {
                "description": "Data actions permitted by the ReadWriteOnlyRole Role Definition"
              }
            }
          },
          "functions": [],
          "variables": {
            "readOnlyRoleDefinitionId": "[guid('sql-read-role-definition-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]",
            "readOnlyRoleAssignmentId": "[guid('sql-read-role-assignment-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]",
            "readWriteRoleDefinitionId": "[guid('sql-write-role-definition-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]",
            "readWriteRoleAssignmentId": "[guid('sql-write-role-assignment-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]"
          },
          "resources": [
            {
              "type": "Microsoft.DocumentDB/databaseAccounts",
              "apiVersion": "2021-03-01-preview",
              "name": "[parameters('accountName')]",
              "location": "[parameters('location')]",
              "kind": "GlobalDocumentDB",
              "properties": {
                "createMode": "Default",
                "consistencyPolicy": {
                  "defaultConsistencyLevel": "Strong"
                },
                "locations": [
                  {
                    "locationName": "[parameters('location')]",
                    "failoverPriority": 0,
                    "isZoneRedundant": false
                  }
                ],
                "databaseAccountOfferType": "Standard",
                "enableAutomaticFailover": false,
                "enableMultipleWriteLocations": false,
                "publicNetworkAccess": "[parameters('publicNetworkAccess')]"
              }
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
              "apiVersion": "2021-03-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), parameters('databaseName'))]",
              "properties": {
                "resource": {
                  "id": "[parameters('databaseName')]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
              "apiVersion": "2021-03-01-preview",
              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('databaseName'), parameters('containerName'))]",
              "location": "[parameters('location')]",
              "tags": {},
              "properties": {
                "resource": {
                  "id": "[parameters('containerName')]",
                  "partitionKey": {
                    "paths": [
                      "/partitionKey"
                    ],
                    "kind": "Hash"
                  },
                  "indexingPolicy": {
                    "indexingMode": "consistent",
                    "includedPaths": [
                      {
                        "path": "/a/b/?",
                        "indexes": [
                          {
                            "kind": "Hash",
                            "dataType": "String",
                            "precision": -1
                          }
                        ]
                      }
                    ],
                    "excludedPaths": [
                      {
                        "path": "/*"
                      }
                    ]
                  },
                  "defaultTtl": 1
                },
                "options": {
                  "throughput": "[parameters('throughput')]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('accountName'), parameters('databaseName'))]",
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readOnlyRoleDefinitionId'))]",
              "properties": {
                "roleName": "[parameters('readOnlyRoleDefinitionName')]",
                "type": "CustomRole",
                "assignableScopes": [
                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
                ],
                "permissions": [
                  {
                    "dataActions": "[parameters('readOnlyRoleDataActions')]"
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readOnlyRoleAssignmentId'))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readOnlyRoleDefinitionId'))]",
                "principalId": "[parameters('readOnlyPrincipalId')]",
                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readOnlyRoleDefinitionId'))]",
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readWriteRoleDefinitionId'))]",
              "properties": {
                "roleName": "[parameters('readWriteRoleDefinitionName')]",
                "type": "CustomRole",
                "assignableScopes": [
                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
                ],
                "permissions": [
                  {
                    "dataActions": "[parameters('readWriteRoleDataActions')]"
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readWriteRoleAssignmentId'))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readWriteRoleDefinitionId'))]",
                "principalId": "[parameters('readWritePrincipalId')]",
                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readWriteRoleDefinitionId'))]",
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            }
          ]
        }
      }
    }
  ]
}
5
  • 1
    Have you tried deploying as an ARM template to see if you get the same error?
    – Mark Brown
    Jun 1, 2021 at 16:09
  • @MarkBrown - I believe it has something to do with Cosmos DB Resource Provider. I noticed that when I perform any resource management operation (like setting tags) on a Cosmos DB account, its status changes to "Updating" and remain like that for some time (from few seconds to few minutes). Any management operation performed during that time results in an error. Same thing does not happen with other resource providers (like Storage accounts for example). Jun 2, 2021 at 2:21
  • Its unclear if this is a problem with the RP or not. That's why I'm asking if the ARM template that this bicep file was built from works. If the template throws the same error, then maybe an issue. If not, then the problem is likely with the bicep file.
    – Mark Brown
    Jun 2, 2021 at 2:44
  • @MarkBrown Hey Mark, thank you for answers. I attached atm template. Result is the same. Maybe you can point sth.
    – gorrch
    Jun 2, 2021 at 6:53
  • @MarkBrown I also tried moving role definition and role assignment to other module, but I can not pass parent resource.
    – gorrch
    Jun 2, 2021 at 9:10

3 Answers 3

2

Currently the Cosmos resource provider only allows you to create one of these at a time. That restriction will be removed in the near future.

As a workaround, chain the second role definition on the previous role assignment so they get created sequentially. This updated ARM template should do the trick.

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.3.539.46024",
      "templateHash": "54838909324108202"
    }
  },
  "functions": [],
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "name": "cosmos_deployment",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "accountName": {
            "value": "add_yours_input"
          },
          "databaseName": {
            "value": "add_yours_input"
          },
          "containerName": {
            "value": "add_yours_input"
          },
          "timeToLive": {
            "value": 2592000
          },
          "readOnlyPrincipalId": {
            "value": "add_yours_input"
          },
          "readWritePrincipalId": {
            "value": "add_yours_input"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.3.539.46024",
              "templateHash": "10083279953983831862"
            }
          },
          "parameters": {
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]"
            },
            "accountName": {
              "type": "string"
            },
            "databaseName": {
              "type": "string"
            },
            "containerName": {
              "type": "string"
            },
            "timeToLive": {
              "type": "int"
            },
            "throughput": {
              "type": "int",
              "defaultValue": 400,
              "metadata": {
                "description": "The throughput for the container"
              },
              "maxValue": 1000000,
              "minValue": 400
            },
            "publicNetworkAccess": {
              "type": "string",
              "defaultValue": "Enabled",
              "allowedValues": [
                "Enabled",
                "Disabled"
              ]
            },
            "readOnlyPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "Object ID of the AAD identity. Must be a GUID."
              }
            },
            "readOnlyRoleDefinitionName": {
              "type": "string",
              "defaultValue": "Read Only Role"
            },
            "readOnlyRoleDataActions": {
              "type": "array",
              "defaultValue": [
                "Microsoft.DocumentDB/databaseAccounts/readMetadata",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/readChangeFeed"
              ],
              "metadata": {
                "description": "Data actions permitted by the ReadOnlyRole Role Definition"
              }
            },
            "readWritePrincipalId": {
              "type": "string",
              "metadata": {
                "description": "Object ID of the AAD identity. Must be a GUID."
              }
            },
            "readWriteRoleDefinitionName": {
              "type": "string",
              "defaultValue": "Read Write Role"
            },
            "readWriteRoleDataActions": {
              "type": "array",
              "defaultValue": [
                "Microsoft.DocumentDB/databaseAccounts/readMetadata",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*",
                "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*"
              ],
              "metadata": {
                "description": "Data actions permitted by the ReadWriteOnlyRole Role Definition"
              }
            }
          },
          "functions": [],
          "variables": {
            "readOnlyRoleDefinitionId": "[guid('sql-read-role-definition-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]",
            "readOnlyRoleAssignmentId": "[guid('sql-read-role-assignment-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]",
            "readWriteRoleDefinitionId": "[guid('sql-write-role-definition-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]",
            "readWriteRoleAssignmentId": "[guid('sql-write-role-assignment-', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName')))]"
          },
          "resources": [
            {
              "type": "Microsoft.DocumentDB/databaseAccounts",
              "apiVersion": "2021-03-01-preview",
              "name": "[parameters('accountName')]",
              "location": "[parameters('location')]",
              "kind": "GlobalDocumentDB",
              "properties": {
                "createMode": "Default",
                "consistencyPolicy": {
                  "defaultConsistencyLevel": "Strong"
                },
                "locations": [
                  {
                    "locationName": "[parameters('location')]",
                    "failoverPriority": 0,
                    "isZoneRedundant": false
                  }
                ],
                "databaseAccountOfferType": "Standard",
                "enableAutomaticFailover": false,
                "enableMultipleWriteLocations": false,
                "publicNetworkAccess": "[parameters('publicNetworkAccess')]"
              }
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
              "apiVersion": "2021-03-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), parameters('databaseName'))]",
              "properties": {
                "resource": {
                  "id": "[parameters('databaseName')]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
              "apiVersion": "2021-03-01-preview",
              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('databaseName'), parameters('containerName'))]",
              "location": "[parameters('location')]",
              "tags": {},
              "properties": {
                "resource": {
                  "id": "[parameters('containerName')]",
                  "partitionKey": {
                    "paths": [
                      "/partitionKey"
                    ],
                    "kind": "Hash"
                  },
                  "indexingPolicy": {
                    "indexingMode": "consistent",
                    "includedPaths": [
                      {
                        "path": "/a/b/?",
                        "indexes": [
                          {
                            "kind": "Hash",
                            "dataType": "String",
                            "precision": -1
                          }
                        ]
                      }
                    ],
                    "excludedPaths": [
                      {
                        "path": "/*"
                      }
                    ]
                  },
                  "defaultTtl": 1
                },
                "options": {
                  "throughput": "[parameters('throughput')]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('accountName'), parameters('databaseName'))]",
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readOnlyRoleDefinitionId'))]",
              "properties": {
                "roleName": "[parameters('readOnlyRoleDefinitionName')]",
                "type": "CustomRole",
                "assignableScopes": [
                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
                ],
                "permissions": [
                  {
                    "dataActions": "[parameters('readOnlyRoleDataActions')]"
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readOnlyRoleAssignmentId'))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readOnlyRoleDefinitionId'))]",
                "principalId": "[parameters('readOnlyPrincipalId')]",
                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readOnlyRoleDefinitionId'))]",
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readWriteRoleDefinitionId'))]",
              "properties": {
                "roleName": "[parameters('readWriteRoleDefinitionName')]",
                "type": "CustomRole",
                "assignableScopes": [
                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
                ],
                "permissions": [
                  {
                    "dataActions": "[parameters('readWriteRoleDataActions')]"
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', variables('readOnlyRoleDefinitionId'))]"
              ]
            },
            {
              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
              "apiVersion": "2020-06-01-preview",
              "name": "[format('{0}/{1}', parameters('accountName'), variables('readWriteRoleAssignmentId'))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readWriteRoleDefinitionId'))]",
                "principalId": "[parameters('readWritePrincipalId')]",
                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('accountName'), variables('readWriteRoleDefinitionId'))]",
                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('accountName'))]"
              ]
            }
          ]
        }
      }
    }
  ]
}
2
  • 2
    You mentioned "That restriction will be removed in the near future." - it has been about four months so just checking in to see when this will be removed. We need to add n number of assignments so we want to use a copy loop, but keep hitting the PreConditionFailed error. (We cant chain them since they are dynamic) Nov 5, 2021 at 0:49
  • "That restriction will be removed in the near future." - is there an issue we could follow for progress? messing with dependencies really hurts in my biceps with conditional resources, loops, etc. Aug 2, 2022 at 13:07
2

To Brian's question above - I was able to resolve mentioned problem related to copy usage by adding @batchSize(1) decorator before the loop(for both role assignment and its parent resource).

This way it deploys resources one by one:

@batchSize(1)
module azureFunction '../modules/app-service/bicep' = [for function in functions: {
  ...
}]

@batchSize(1)
module sqlRoleAssignment '../modules/sql-role-assignment.bicep' = [for function in functions: {
  ...
}]
0

Try using dependsOn:[] - https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/resource-dependencies#explicit-dependency between each of the assignments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.