{Role} `az role assignment create`: Show warning if `--scope` argument is not specified #24755

jiasli · 2022-11-28T06:43:56Z

Description
Similar to #20965
A temporary warning for #24753

For az role assignment create, --scope defaults to the subscription. Without explicit consent from the user on the --scope, this behavior is considered Elevation of Privilege.

This PR adds a warning if --scope is not specified:

> az role assignment create --assignee 5963f50c-7c43-405c-af7e-53294de76abd --role Reader --resource-group clitest.rgizxewh7npwdc63xpadmmi73hvq5ftcza2acf5wiyulxnjy5fgujpvvqll63kndkru
Starting from Azure CLI 2.47.0, --scopes argument will become required for creating role assignments. Please explicitly specify --scopes.
{
  "canDelegate": null,
  "condition": null,
  "conditionVersion": null,
  "description": null,
  "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/clitest.rgizxewh7npwdc63xpadmmi73hvq5ftcza2acf5wiyulxnjy5fgujpvvqll63kndkru/providers/Microsoft.Authorization/roleAssignments/3a36df35-93c4-4e5b-b605-61e9f9a0f1fc",
  "name": "3a36df35-93c4-4e5b-b605-61e9f9a0f1fc",
  "principalId": "5963f50c-7c43-405c-af7e-53294de76abd",
  "principalName": "[email protected]",
  "principalType": "User",
  "resourceGroup": "clitest.rgizxewh7npwdc63xpadmmi73hvq5ftcza2acf5wiyulxnjy5fgujpvvqll63kndkru",
  "roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "roleDefinitionName": "Reader",
  "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/clitest.rgizxewh7npwdc63xpadmmi73hvq5ftcza2acf5wiyulxnjy5fgujpvvqll63kndkru",
  "type": "Microsoft.Authorization/roleAssignments"
}

Even if --resource-group or --subscription is specified, we still show this warning because as described in #24753, we may drop --resource-group and --subscription, so --scope should always be used as the unified, all-in-one argument for specifying the role assignment scope.

Related PR: #25283

History Notes

[Role] az role assignment create: Show warning if --scope argument is not specified: --scope argument will become required for creating a role assignment in the breaking change release of the fall of 2023. Please explicitly specify --scope.

yonzhan · 2022-11-28T08:01:49Z

Role

jiasli · 2023-02-17T09:23:06Z

src/azure-cli/azure/cli/command_modules/role/custom.py

    "The output includes credentials that you must protect. Be sure that you do not include these credentials in "
    "your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli")

+SCOPE_WARNING = "In a future release, --scope argument will become required for creating a role assignment. " \


Similar to #20965, we can't give an exact version yet.

@jiasli , but can't we at least give the anticipated breaking change (BK) window as are BKs are moving to a bi-annual schedule?

this should also be consistent with the content on line 688.
We can mention something like "breaking change of Fall of 2023".

src/azure-cli/azure/cli/command_modules/role/_help.py

dcaro

@jiasli just a suggestion about the name.
We need to give a more specific timeline.

dcaro · 2023-02-22T17:46:21Z

src/azure-cli/azure/cli/command_modules/role/_help.py

 helps['role assignment create'] = """
 type: command
 short-summary: Create a new role assignment for a user, group, or service principal.
+long-summary: In a future release, --scope argument will become required for creating a role assignment. Please explicitly specify --scope.


@jiasli We should be specific about the timeline.

Suggested change

long-summary: In a future release, --scope argument will become required for creating a role assignment. Please explicitly specify --scope.

long-summary: --scope argument will become required for creating a role assignment in the breaking change release of the fall of 2023. Please explicitly specify --scope.

src/azure-cli/azure/cli/command_modules/role/_help.py

dbradish-microsoft · 2023-02-23T18:35:36Z

src/azure-cli/azure/cli/command_modules/role/custom.py

    "The output includes credentials that you must protect. Be sure that you do not include these credentials in "
    "your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli")

+SCOPE_WARNING = "In a future release, --scope argument will become required for creating a role assignment. " \


@jiasli , but can't we at least give the anticipated breaking change (BK) window as are BKs are moving to a bi-annual schedule?

Co-authored-by: Delora Bradish <[email protected]>

jiasli · 2023-02-24T01:38:03Z

We will also need to refine the conceptual doc: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli

dcaro

LGTM

…t is not specified (Azure#24755)

ghost requested a review from yonzhan November 28, 2022 06:44

ghost added the Auto-Assign Auto assign by bot label Nov 28, 2022

ghost assigned jiasli Nov 28, 2022

ghost added this to the Nov 2022 (2022-12-06) milestone Nov 28, 2022

ghost added the RBAC az role label Nov 28, 2022

jiasli modified the milestones: Nov 2022 (2022-12-06), Dec 2022 (2023-01-03) Dec 1, 2022

yonzhan modified the milestones: Dec 2022 (2023-01-10), Jan 2023 (2023-02-07) Jan 6, 2023

yonzhan modified the milestones: Jan 2023 (2023-02-07), Feb 2023 (2023-03-07) Feb 3, 2023

role-assignment-scope

db424a7

jiasli force-pushed the role-assignment-scope branch from c30e32b to db424a7 Compare February 17, 2023 09:22

jiasli commented Feb 17, 2023

View reviewed changes

jiasli marked this pull request as ready for review February 17, 2023 09:23

jiasli requested review from calvinhzy and evelyn-ys as code owners February 17, 2023 09:23

jiasli requested review from dbradish-microsoft and dcaro February 17, 2023 09:35

jiasli commented Feb 22, 2023

View reviewed changes

src/azure-cli/azure/cli/command_modules/role/_help.py Outdated Show resolved Hide resolved

dcaro reviewed Feb 22, 2023

View reviewed changes

dbradish-microsoft requested changes Feb 23, 2023

View reviewed changes

Update src/azure-cli/azure/cli/command_modules/role/_help.py

d046a3b

Co-authored-by: Delora Bradish <[email protected]>

update

9715db5

dbradish-microsoft approved these changes Feb 24, 2023

View reviewed changes

yonzhan approved these changes Feb 24, 2023

View reviewed changes

evelyn-ys approved these changes Feb 24, 2023

View reviewed changes

dcaro approved these changes Feb 24, 2023

View reviewed changes

jiasli changed the title ~~{Role} az role assignment create: Show warning when scope defaults to subscription~~ {Role} az role assignment create: Show warning when --scope argument is not specified Feb 24, 2023

jiasli changed the title ~~{Role} az role assignment create: Show warning when --scope argument is not specified~~ {Role} az role assignment create: Show warning if --scope argument is not specified Feb 24, 2023

jiasli merged commit 00fe3e5 into Azure:dev Feb 24, 2023

jiasli deleted the role-assignment-scope branch February 24, 2023 03:40

dcaro mentioned this pull request Feb 24, 2023

[Compute] az vm/vmss identity assign: Add warning log and modify help to inform that the default value Contributor of --role will be removed #25283

Merged

3 tasks

avgale pushed a commit to avgale/azure-cli that referenced this pull request Aug 24, 2023

{Role} az role assignment create: Show warning if --scope argumen…

86c9a42

…t is not specified (Azure#24755)

jiasli mentioned this pull request Oct 20, 2023

[Role] BREAKING CHANGE: az role assignment create: --scope is now a required argument #27651

Merged

jiasli mentioned this pull request Dec 5, 2024

{Role} az role assignment list/delete: Show warning if --scope argument is not specified #30472

Draft

3 tasks

	long-summary: In a future release, --scope argument will become required for creating a role assignment. Please explicitly specify --scope.
	long-summary: --scope argument will become required for creating a role assignment in the breaking change release of the fall of 2023. Please explicitly specify --scope.

{Role} az role assignment create: Show warning if --scope argument is not specified #24755

{Role} az role assignment create: Show warning if --scope argument is not specified #24755

Uh oh!

Conversation

jiasli commented Nov 28, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonzhan commented Nov 28, 2022

Uh oh!

jiasli Feb 17, 2023

Choose a reason for hiding this comment

Uh oh!

dbradish-microsoft Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

dcaro Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dcaro left a comment

Choose a reason for hiding this comment

Uh oh!

dcaro Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

dcaro Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dbradish-microsoft Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

jiasli commented Feb 24, 2023

Uh oh!

dcaro left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

{Role} `az role assignment create`: Show warning if `--scope` argument is not specified #24755

{Role} `az role assignment create`: Show warning if `--scope` argument is not specified #24755

jiasli commented Nov 28, 2022 •

edited

Loading