Azure-cli: az role definition update - wrong example

[anoff]

I am trying to create and update custom roles. However I'm facing issues when running the update command using a role definition that worked perfectly when creating a custom role. It seems that the example to update a definition is a copy&paste error as it actually uses the create command. Wondering how the role definition needs to look to prevent the following error during an update operation

▶ az role definition update --role-definition roles/keyvault.json
Please provide the unique logic name of an existing role

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 40e649cf-40e3-1b9e-141a-c62d244eda61
• Version Independent ID: 78ea89c1-7c56-e33b-d10a-dae05642aa34
• Content: az role definition
• Content Source: src/command_modules/azure-cli-role/azure/cli/command_modules/role/_help.py
• Service: azure-resource-manager
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[anoff]

Update regarding the error I received:

• created a role with 2 assignable subscriptions (A + B)
• az account set was set to B
• create role definition, assuming it would end up in scope B as it is default for other resources being created, turns out to be a resource in A (I guess since it was listed first in assignable scopes)
• error occured when I tried to remove subscription A and add C

So I guess the error Please provide the unique logic name of an existing role actually means Can not remove subscription where Role is defined or something

[yugangw-msft]

It is a CLI bug that we are not resolving the role definitions from the assignable scopes correctly.
@anoff Sorry for the delay in response. For now the reliable workaround is to delete and recreate the definition before we release the fix

[freedumb]

Is this bug resolved? If I'm reading it correctly, the role definition update functionality does not work?

[ghost]

Does this seem similar to https://github.com/Azure/azure-cli/issues/2745 ?
I am unable to update an existing role definition when assigned across multiple subscriptions (even though, I am in owner role across all subscriptions). I end up with similar:

"Please provide the unique logic name of an existing role"

This happens if in my role def I use the friendly "name" or the guid value..

[ghost]

Just a follow up - this works perfectly fine in PowerShell - it seems only a fault of Azure CLI.

[yugangw-msft]

I have the fix submitted, the key is to use the output of "az role definition create/list" to construct the input for update. The difference is there is the id which tells CLI the right subscription to use.

[santy8a]

I have the fix submitted, the key is to use the output of "az role definition create/list" to construct the input for update. The difference is there is the id which tells CLI the right subscription to use.

I have done it but it still does not work. The issue is when I try add other subscription in "assignableScopes"

[yugangw-msft]

@santy8a, did you get the same error?

[santy8a]

@santy8a, did you get the same error?

Yes. Same error.

This is my custom role

I created this file using this command. It is right?

az role definition list --name "Uses Case Role" --query [0] > /tmp/uses_case.json

But. when I try to update

$ az role definition update --role-definition /tmp/uses_case.json
Please provide the unique logic name of an existing role

[yugangw-msft]

@santy8a, the id is not respected right now but my PR will do. So please use the upcoming release

[santy8a]

Thanks a lot @yugangw-msft ,
Do you know when is upcoming release?

[yugangw-msft]

@santy8a, it will be around tomorrow

[santy8a]

Great, thank you very much