[Role] az role assignment list: Add --at-scope
#31179
Conversation
️✔️AzureCLI-FullTest
|
|
| rule | cmd_name | rule_message | suggest_message |
|---|---|---|---|
| role assignment list | cmd role assignment list added parameter at_scope |
||
| role assignment list | cmd role assignment list update parameter show_all: added property deprecate_info_target=--all |
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
| assignments = _search_role_assignments(cmd.cli_ctx, assignments_client, definitions_client, | ||
| scope, assignee, role, include_inherited, | ||
| include_groups=False) | ||
| include_groups=False, at_scope=True) |
There was a problem hiding this comment.
I am hesitating on whether --at-scope should be exposed by az role assignment delete, as setting --at-scope false will include subscope assignments, causing accidental deletion.
| filters.append("assignedTo('{}')".format(assignee_object_id)) | ||
| else: | ||
| f = "principalId eq '{}'".format(assignee_object_id) | ||
| assignments = list(assignments_client.list_for_subscription(filter=f)) |
There was a problem hiding this comment.
There is no need to call list_for_subscription at all. Its functionality is already covered by list_for_scope.
jiasli
changed the title
az role assignment list: Add --at-scope argumentaz role assignment list: Add --at-scope
| if assignee_object_id and not include_groups and not at_scope: | ||
| filters.append("principalId eq '{}'".format(assignee_object_id)) |
There was a problem hiding this comment.
Now with the ability to turn off atScope(), principalId eq '{}' filter can be used with scope, fixing #14302 (comment).
|
The history note triggers a false positive in Check the Format of Pull Request Title and Content task. It should be changed after the PR is merged: [Role] |
|
I'd like to propose a new design to solve issue 1🍎 and issue 2🍐 which requires less customer modification. We can reuse
|
3 participants
Related command
az role assignment listDescription
Fix #29407
Prerequisite of fixing #14302
Currently for
az role assignment list,--scopeand--allare mutually exclusive. When--allis specified,scopeis set toNone:azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py
Lines 242 to 245 in a4c9d4d
When
--scopeis specified,atScope()is enforced:azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py
Lines 516 to 517 in a4c9d4d
Note
$filter=atScope(): Lists role assignments for only the specified scope, not including the role assignments at subscopes.This produces 3 issues:
--allforcesscopeto be the subscription.scopewithoutatScope()(Role assigned to scope not returned unless scope is specified #14302 (comment)).atScope()andprincipalId eq '{value}'are mutually exclusive in REST API, CLI'sscopeandassignee_object_idare mutually exclusive too (Role assigned to scope not returned unless scope is specified #14302 (comment)). A client-side filtering is needed to solve it.This PR deprecates
--all(solves issue 1 🍎) and adds--at-scopeargument so thatatScope()is no longer enforced. Specifying--at-scope falsewill allow listing role assignments at customscopewithoutatScope()(solves issue 2 🍐) and withprincipalId eq '{value}'(solves issue 2 🍋).Testing Guide
History Notes