Code: InvalidTemplateDeployment

[clifpi]

Hello,
I have owner access to a subscription and trying to deploy a hub and constant receive the following:
{
"code": "DeploymentFailed",
"target": "/subscriptions/829/resourceGroups/rg-s/providers/Microsoft.Resources/deployments/hub",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
"details": [
{
"code": "InvalidTemplateDeployment",
"message": "The template deployment failed with error: 'Authorization failed for template resource 'a6' of type 'Microsoft.Authorization/roleAssignments'. The client 'admin-hub' with object id '9' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/82/resourceGroups/rg-dev/providers/Microsoft.Storage/storageAccounts/finopshub1envr6qrsubjru/providers/Microsoft.Authorization/roleAssignments/a60'.'."
}

[clifpi]

Any thoughts here? I am trying to also connect after this error and get "Access to resources is forbidden" when I try to use the SAS token.

[clifpi]

[flanakin]

@clifpi I can't explain the deployment failure. I would recommend filing a support request against ARM for that one. We would need their help to investigate. I also can't explain the "a9" resource name or "6" object ID reference. Those generally aren't valid and wouldn't come from us as far as I'm aware. Was the template customized in any way?

For the SAS token, my first guess would be that the token doesn't have the right level of access. Can you review these instructions to make sure it's configured correctly?

https://learn.microsoft.com/cloud-computing/finops/toolkit/power-bi/setup#use-a-sas-token-to-connect-data-to-a-report

#needsinfo

[philipstreet]

I am having the same issue using the "Deploy to Azure" link to deploy a "FinOps Hub".

I think the error relates to the role assignments on the "finopshub..." Storage Account. The template contains the following code;

"blobUploadRbacRoles": [
    "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
    "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
    "69566ab7-960f-475b-8e7c-b3118f30c6bd"
]
.
.
.
{
    "copy": {
        "name": "identityRoleAssignments",
        "count": "[length(variables('blobUploadRbacRoles'))]"
    },
    "type": "Microsoft.Authorization/roleAssignments",
    "apiVersion": "2022-04-01",
    "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), variables('blobUploadRbacRoles')[copyIndex()], resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('{0}_blobManager', variables('storageAccountName'))))]",
    "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('blobUploadRbacRoles')[copyIndex()])]",
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('{0}_blobManager', variables('storageAccountName'))), '2023-01-31').principalId]",
        "principalType": "ServicePrincipal"
    },
    "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('{0}_blobManager', variables('storageAccountName')))]",
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
    ]
},

The RBAC roles are:

• ba92f5b4-2d11-453d-a403-e96b0029c9fe : Storage Blob Data Contributor
• e40ec5ca-96e0-45a2-b4ff-59039f2c2b59 : Managed Identity Contributor
• 69566ab7-960f-475b-8e7c-b3118f30c6bd : Storage File Data Privilege Contributor

I can apply the 1st & 3rd roles in the Portal, but I am not able to apply the 2nd one. Could this be the issue?