azurerm_role_assignment - Support scope to be /providers/Microsoft.Marketplace

internal/services/authorization/parse/role_assignment.go

@@ -2,36 +2,37 @@ package parse
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 
 	"github.com/hashicorp/terraform-provider-azurerm/helpers/azure"
 )
 
 type RoleAssignmentId struct {
-	SubscriptionID      string
-	ResourceGroup       string
-	ManagementGroup     string
-	ResourceScope       string
-	ResourceProvider    string
-	Name                string
-	TenantId            string
-	IsSubscriptionLevel bool
+	SubscriptionID   string
+	ResourceGroup    string
+	ManagementGroup  string
+	ResourceScope    string
+	ResourceProvider string
+	Name             string
+	TenantId         string
+	IsRootLevel      bool
 }
 
-func NewRoleAssignmentID(subscriptionId, resourceGroup, resourceProvider, resourceScope, managementGroup, name, tenantId string, isSubLevel bool) (*RoleAssignmentId, error) {
-	if subscriptionId == "" && resourceGroup == "" && managementGroup == "" && !isSubLevel {
-		return nil, fmt.Errorf("one of subscriptionId, resourceGroup, managementGroup or isSubscriptionLevel must be provided")
+func NewRoleAssignmentID(subscriptionId, resourceGroup, resourceProvider, resourceScope, managementGroup, name, tenantId string, isRootLevel bool) (*RoleAssignmentId, error) {
+	if subscriptionId == "" && resourceGroup == "" && managementGroup == "" && !isRootLevel {
+		return nil, fmt.Errorf("one of subscriptionId, resourceGroup, managementGroup or isRootLevel must be provided")
 	}
 
 	if managementGroup != "" {
-		if subscriptionId != "" || resourceGroup != "" || isSubLevel {
-			return nil, fmt.Errorf("cannot provide subscriptionId, resourceGroup or isSubscriptionLevel when managementGroup is provided")
+		if subscriptionId != "" || resourceGroup != "" || isRootLevel {
+			return nil, fmt.Errorf("cannot provide subscriptionId, resourceGroup or isRootLevel when managementGroup is provided")
 		}
 	}
 
-	if isSubLevel {
+	if isRootLevel {
 		if subscriptionId != "" || resourceGroup != "" || managementGroup != "" {
-			return nil, fmt.Errorf("cannot provide subscriptionId, resourceGroup or managementGroup when isSubscriptionLevel is provided")
+			return nil, fmt.Errorf("cannot provide subscriptionId, resourceGroup or managementGroup when isRootLevel is provided")
 		}
 	}
 
@@ -42,14 +43,14 @@ func NewRoleAssignmentID(subscriptionId, resourceGroup, resourceProvider, resour
 	}
 
 	return &RoleAssignmentId{
-		SubscriptionID:      subscriptionId,
-		ResourceGroup:       resourceGroup,
-		ResourceProvider:    resourceProvider,
-		ResourceScope:       resourceScope,
-		ManagementGroup:     managementGroup,
-		Name:                name,
-		TenantId:            tenantId,
-		IsSubscriptionLevel: isSubLevel,
+		SubscriptionID:   subscriptionId,
+		ResourceGroup:    resourceGroup,
+		ResourceProvider: resourceProvider,
+		ResourceScope:    resourceScope,
+		ManagementGroup:  managementGroup,
+		Name:             name,
+		TenantId:         tenantId,
+		IsRootLevel:      isRootLevel,
 	}, nil
 }
 
@@ -71,9 +72,9 @@ func (id RoleAssignmentId) AzureResourceID() string {
 		return fmt.Sprintf(fmtString, id.SubscriptionID, id.ResourceGroup, id.Name)
 	}
 
-	if id.IsSubscriptionLevel {
-		fmtString := "/providers/Microsoft.Subscription/providers/Microsoft.Authorization/roleAssignments/%s"
-		return fmt.Sprintf(fmtString, id.Name)
+	if id.IsRootLevel {
+		fmtString := "/providers/%s/providers/Microsoft.Authorization/roleAssignments/%s"
+		return fmt.Sprintf(fmtString, id.ResourceProvider, id.Name)
 	}
 
 	fmtString := "/subscriptions/%s/providers/Microsoft.Authorization/roleAssignments/%s"
@@ -124,16 +125,6 @@ func RoleAssignmentID(input string) (*RoleAssignmentId, error) {
 		if roleAssignmentId.Name, err = id.PopSegment("roleAssignments"); err != nil {
 			return nil, err
 		}
-	case strings.HasPrefix(input, "/providers/Microsoft.Subscription/"):
-		idParts := strings.Split(input, "/providers/Microsoft.Authorization/roleAssignments/")
-		if len(idParts) != 2 {
-			return nil, fmt.Errorf("could not parse Role Assignment ID %q for subscription scope", input)
-		}
-		roleAssignmentId.IsSubscriptionLevel = true
-		if idParts[1] == "" {
-			return nil, fmt.Errorf("ID was missing a value for the roleAssignments element")
-		}
-		roleAssignmentId.Name = idParts[1]
 	case strings.HasPrefix(input, "/providers/Microsoft.Management/"):
 		idParts := strings.Split(input, "/providers/Microsoft.Authorization/roleAssignments/")
 		if len(idParts) != 2 {
@@ -145,7 +136,15 @@ func RoleAssignmentID(input string) (*RoleAssignmentId, error) {
 		roleAssignmentId.Name = idParts[1]
 		roleAssignmentId.ManagementGroup = strings.TrimPrefix(idParts[0], "/providers/Microsoft.Management/managementGroups/")
 	default:
-		return nil, fmt.Errorf("could not parse Role Assignment ID %q", input)
+		re := regexp.MustCompile(`^/providers/(Microsoft.[a-zA-Z]+)/providers/Microsoft.Authorization/roleAssignments/([a-fA-F\d]{8}-[a-fA-F\d]{4}-[a-fA-F\d]{4}-[a-fA-F\d]{4}-[a-fA-F\d]{12})$`)
+		matches := re.FindStringSubmatch(input)
+		if len(matches) != 3 {
+			return nil, fmt.Errorf("could not parse Role Assignment ID %q", input)
+		}
+
+		roleAssignmentId.IsRootLevel = true
+		roleAssignmentId.ResourceProvider = matches[1]
+		roleAssignmentId.Name = matches[2]
 	}
 
 	return &roleAssignmentId, nil

internal/services/authorization/parse/role_assignment_test.go

@@ -10,15 +10,15 @@ var _ resourceid.Formatter = RoleAssignmentId{}
 
 func TestRoleAssignmentIDFormatter(t *testing.T) {
 	testData := []struct {
-		SubscriptionId      string
-		ResourceGroup       string
-		ResourceProvider    string
-		ResourceScope       string
-		ManagementGroup     string
-		IsSubscriptionLevel bool
-		Name                string
-		TenantId            string
-		Expected            string
+		SubscriptionId   string
+		ResourceGroup    string
+		ResourceProvider string
+		ResourceScope    string
+		ManagementGroup  string
+		IsRootLevel      bool
+		Name             string
+		TenantId         string
+		Expected         string
 	}{
 		{
 			SubscriptionId:  "",
@@ -91,15 +91,23 @@ func TestRoleAssignmentIDFormatter(t *testing.T) {
 			Expected:         "/subscriptions/12345678-1234-9876-4563-123456789012/resourceGroups/group1/providers/Microsoft.Storage/storageAccounts/nameStorageAccount/providers/Microsoft.Authorization/roleAssignments/23456781-2349-8764-5631-234567890121|34567812-3456-7653-6742-345678901234",
 		},
 		{
-			IsSubscriptionLevel: true,
-			Name:                "23456781-2349-8764-5631-234567890121",
-			TenantId:            "34567812-3456-7653-6742-345678901234",
-			Expected:            "/providers/Microsoft.Subscription/providers/Microsoft.Authorization/roleAssignments/23456781-2349-8764-5631-234567890121|34567812-3456-7653-6742-345678901234",
+			IsRootLevel:      true,
+			ResourceProvider: "Microsoft.Subscription",
+			Name:             "23456781-2349-8764-5631-234567890121",
+			TenantId:         "34567812-3456-7653-6742-345678901234",
+			Expected:         "/providers/Microsoft.Subscription/providers/Microsoft.Authorization/roleAssignments/23456781-2349-8764-5631-234567890121|34567812-3456-7653-6742-345678901234",
+		},
+		{
+			IsRootLevel:      true,
+			ResourceProvider: "Microsoft.Marketplace",
+			Name:             "23456781-2349-8764-5631-234567890121",
+			TenantId:         "34567812-3456-7653-6742-345678901234",
+			Expected:         "/providers/Microsoft.Marketplace/providers/Microsoft.Authorization/roleAssignments/23456781-2349-8764-5631-234567890121|34567812-3456-7653-6742-345678901234",
 		},
 	}
 	for _, v := range testData {
 		t.Logf("testing %+v", v)
-		actual, err := NewRoleAssignmentID(v.SubscriptionId, v.ResourceGroup, v.ResourceProvider, v.ResourceScope, v.ManagementGroup, v.Name, v.TenantId, v.IsSubscriptionLevel)
+		actual, err := NewRoleAssignmentID(v.SubscriptionId, v.ResourceGroup, v.ResourceProvider, v.ResourceScope, v.ManagementGroup, v.Name, v.TenantId, v.IsRootLevel)
 		if err != nil {
 			if v.Expected == "" {
 				continue
@@ -165,8 +173,19 @@ func TestRoleAssignmentID(t *testing.T) {
 			// valid at subscriptions scope
 			Input: "/providers/Microsoft.Subscription/providers/Microsoft.Authorization/roleAssignments/23456781-2349-8764-5631-234567890121",
 			Expected: &RoleAssignmentId{
-				IsSubscriptionLevel: true,
-				Name:                "23456781-2349-8764-5631-234567890121",
+				IsRootLevel:      true,
+				ResourceProvider: "Microsoft.Subscription",
+				Name:             "23456781-2349-8764-5631-234567890121",
+			},
+		},
+
+		{
+			// valid at marketplace scope
+			Input: "/providers/Microsoft.Marketplace/providers/Microsoft.Authorization/roleAssignments/23456781-2349-8764-5631-234567890121",
+			Expected: &RoleAssignmentId{
+				IsRootLevel:      true,
+				ResourceProvider: "Microsoft.Marketplace",
+				Name:             "23456781-2349-8764-5631-234567890121",
 			},
 		},
 

internal/services/authorization/role_assignment_resource.go

@@ -60,6 +60,7 @@ func resourceArmRoleAssignment() *pluginsdk.Resource {
 					// It seems only user account is allowed to be elevated access.
 					validation.StringInSlice([]string{
 						"/providers/Microsoft.Subscription",
+						"/providers/Microsoft.Marketplace",
 					}, false),
 
 					billingValidate.EnrollmentID,

internal/services/authorization/role_assignment_resource_test.go

@@ -246,6 +246,20 @@ func TestAccRoleAssignment_subscriptionScoped(t *testing.T) {
 	})
 }
 
+func TestAccRoleAssignment_marketPlaceScoped(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_role_assignment", "test")
+	r := RoleAssignmentResource{}
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.marketPlaceScoped(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
+	})
+}
+
 func (r RoleAssignmentResource) Exists(ctx context.Context, client *clients.Client, state *pluginsdk.InstanceState) (*bool, error) {
 	id, err := parse.RoleAssignmentID(state.ID)
 	if err != nil {
@@ -588,3 +602,25 @@ resource "azurerm_role_assignment" "test" {
 }
 `, data.RandomInteger)
 }
+
+func (RoleAssignmentResource) marketPlaceScoped(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azuread_application" "test" {
+  display_name = "acctestspa%d"
+}
+
+resource "azuread_service_principal" "test" {
+  application_id = azuread_application.test.application_id
+}
+
+resource "azurerm_role_assignment" "test" {
+  scope                = "/providers/Microsoft.Marketplace"
+  role_definition_name = "Marketplace Admin"
+  principal_id         = azuread_service_principal.test.object_id
+}
+`, data.RandomInteger)
+}

website/docs/r/role_assignment.html.markdown

@@ -132,15 +132,15 @@ The following arguments are supported:
 
 * `name` - (Optional) A unique UUID/GUID for this Role Assignment - one will be generated if not specified. Changing this forces a new resource to be created.
 
-* `scope` - (Required) The scope at which the Role Assignment applies to, such as `/subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333`, `/subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup`, or `/subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM`, or `/providers/Microsoft.Management/managementGroups/myMG`. Changing this forces a new resource to be created.
+* `scope` - (Required) The scope at which the Role Assignment applies to, such as `/subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333`, `/subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup`, or `/subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM`, or `/providers/Microsoft.Management/managementGroups/myMG`, or `/providers/Microsoft.Marketplace`. Changing this forces a new resource to be created.
 
 * `role_definition_id` - (Optional) The Scoped-ID of the Role Definition. Changing this forces a new resource to be created. Conflicts with `role_definition_name`.
 
 * `role_definition_name` - (Optional) The name of a built-in Role. Changing this forces a new resource to be created. Conflicts with `role_definition_id`.
 
 * `principal_id` - (Required) The ID of the Principal (User, Group or Service Principal) to assign the Role Definition to. Changing this forces a new resource to be created.
 
-~> **NOTE:** The Principal ID is also known as the Object ID (ie not the "Application ID" for applications).
+~> **NOTE:** The Principal ID is also known as the Object ID (ie not the "Application ID" for applications). To assign Azure roles, the Principal mush have `Microsoft.Authorization/roleAssignments/write` permissions. See [documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal) for more information.
 
 * `condition` - (Optional) The condition that limits the resources that the role can be assigned to. Changing this forces a new resource to be created.