Class Assignment

Assigns a given Principal (User or Group) to a given Role.

Example Usage (using a built-in Role)

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
public MyStack()
{
    var primary = Output.Create(Azure.Core.GetSubscription.InvokeAsync());
    var exampleClientConfig = Output.Create(Azure.Core.GetClientConfig.InvokeAsync());
    var exampleAssignment = new Azure.Authorization.Assignment("exampleAssignment", new Azure.Authorization.AssignmentArgs
    {
        Scope = primary.Apply(primary => primary.Id),
        RoleDefinitionName = "Reader",
        PrincipalId = exampleClientConfig.Apply(exampleClientConfig => exampleClientConfig.ObjectId),
    });
}

}

Example Usage (Custom Role & Service Principal)

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
public MyStack()
{
    var primary = Output.Create(Azure.Core.GetSubscription.InvokeAsync());
    var exampleClientConfig = Output.Create(Azure.Core.GetClientConfig.InvokeAsync());
    var exampleRoleDefinition = new Azure.Authorization.RoleDefinition("exampleRoleDefinition", new Azure.Authorization.RoleDefinitionArgs
    {
        RoleDefinitionId = "00000000-0000-0000-0000-000000000000",
        Scope = primary.Apply(primary => primary.Id),
        Permissions = 
        {
            new Azure.Authorization.Inputs.RoleDefinitionPermissionArgs
            {
                Actions = 
                {
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                },
                NotActions = {},
            },
        },
        AssignableScopes = 
        {
            primary.Apply(primary => primary.Id),
        },
    });
    var exampleAssignment = new Azure.Authorization.Assignment("exampleAssignment", new Azure.Authorization.AssignmentArgs
    {
        Name = "00000000-0000-0000-0000-000000000000",
        Scope = primary.Apply(primary => primary.Id),
        RoleDefinitionId = exampleRoleDefinition.Id,
        PrincipalId = exampleClientConfig.Apply(exampleClientConfig => exampleClientConfig.ObjectId),
    });
}

}

Example Usage (Custom Role & User)

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
public MyStack()
{
    var primary = Output.Create(Azure.Core.GetSubscription.InvokeAsync());
    var exampleClientConfig = Output.Create(Azure.Core.GetClientConfig.InvokeAsync());
    var exampleRoleDefinition = new Azure.Authorization.RoleDefinition("exampleRoleDefinition", new Azure.Authorization.RoleDefinitionArgs
    {
        RoleDefinitionId = "00000000-0000-0000-0000-000000000000",
        Scope = primary.Apply(primary => primary.Id),
        Permissions = 
        {
            new Azure.Authorization.Inputs.RoleDefinitionPermissionArgs
            {
                Actions = 
                {
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                },
                NotActions = {},
            },
        },
        AssignableScopes = 
        {
            primary.Apply(primary => primary.Id),
        },
    });
    var exampleAssignment = new Azure.Authorization.Assignment("exampleAssignment", new Azure.Authorization.AssignmentArgs
    {
        Name = "00000000-0000-0000-0000-000000000000",
        Scope = primary.Apply(primary => primary.Id),
        RoleDefinitionId = exampleRoleDefinition.Id,
        PrincipalId = exampleClientConfig.Apply(exampleClientConfig => exampleClientConfig.ClientId),
    });
}

}

Example Usage (Custom Role & Management Group)

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
public MyStack()
{
    var primary = Output.Create(Azure.Core.GetSubscription.InvokeAsync());
    var exampleClientConfig = Output.Create(Azure.Core.GetClientConfig.InvokeAsync());
    var exampleGroup = Output.Create(Azure.Management.GetGroup.InvokeAsync());
    var exampleRoleDefinition = new Azure.Authorization.RoleDefinition("exampleRoleDefinition", new Azure.Authorization.RoleDefinitionArgs
    {
        RoleDefinitionId = "00000000-0000-0000-0000-000000000000",
        Scope = primary.Apply(primary => primary.Id),
        Permissions = 
        {
            new Azure.Authorization.Inputs.RoleDefinitionPermissionArgs
            {
                Actions = 
                {
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                },
                NotActions = {},
            },
        },
        AssignableScopes = 
        {
            primary.Apply(primary => primary.Id),
        },
    });
    var exampleAssignment = new Azure.Authorization.Assignment("exampleAssignment", new Azure.Authorization.AssignmentArgs
    {
        Name = "00000000-0000-0000-0000-000000000000",
        Scope = data.Azurerm_management_group.Primary.Id,
        RoleDefinitionId = exampleRoleDefinition.Id,
        PrincipalId = exampleClientConfig.Apply(exampleClientConfig => exampleClientConfig.ClientId),
    });
}

}
Inheritance
System.Object
Resource
CustomResource
Assignment
Inherited Members
System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.ToString()
Namespace: Pulumi.Azure.Role
Assembly: Pulumi.Azure.dll
Syntax
[Obsolete("azure.role.Assignment has been deprecated in favor of azure.authorization.Assignment")]
public class Assignment : CustomResource

Constructors

View Source

Assignment(String, AssignmentArgs, CustomResourceOptions)

Create a Assignment resource with the given unique name, arguments, and options.

Declaration
public Assignment(string name, AssignmentArgs args, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resource
AssignmentArgs args

The arguments used to populate this resource's properties
CustomResourceOptions options

A bag of options that control this resource's behavior

Properties

View Source

Name

A unique UUID/GUID for this Role Assignment - one will be generated if not specified. Changing this forces a new resource to be created.

Declaration
public Output<string> Name { get; }
Property Value
Type Description
Output<System.String>
View Source

PrincipalId

The ID of the Principal (User, Group or Service Principal) to assign the Role Definition to. Changing this forces a new resource to be created.

Declaration
public Output<string> PrincipalId { get; }
Property Value
Type Description
Output<System.String>
View Source

PrincipalType

The type of the principal_id, e.g. User, Group, Service Principal, Application, etc.

Declaration
public Output<string> PrincipalType { get; }
Property Value
Type Description
Output<System.String>
View Source

RoleDefinitionId

The Scoped-ID of the Role Definition. Changing this forces a new resource to be created. Conflicts with role_definition_name.

Declaration
public Output<string> RoleDefinitionId { get; }
Property Value
Type Description
Output<System.String>
View Source

RoleDefinitionName

The name of a built-in Role. Changing this forces a new resource to be created. Conflicts with role_definition_id.

Declaration
public Output<string> RoleDefinitionName { get; }
Property Value
Type Description
Output<System.String>
View Source

Scope

The scope at which the Role Assignment applies to, such as /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup, or /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourceGroups/myGroup/providers/Microsoft.Compute/virtualMachines/myVM, or /providers/Microsoft.Management/managementGroups/myMG. Changing this forces a new resource to be created.

Declaration
public Output<string> Scope { get; }
Property Value
Type Description
Output<System.String>
View Source

SkipServicePrincipalAadCheck

If the principal_id is a newly provisioned Service Principal set this value to true to skip the Azure Active Directory check which may fail due to replication lag. This argument is only valid if the principal_id is a Service Principal identity. If it is not a Service Principal identity it will cause the role assignment to fail. Defaults to false.

Declaration
public Output<bool> SkipServicePrincipalAadCheck { get; }
Property Value
Type Description
Output<System.Boolean>

Methods

View Source

Get(String, Input<String>, AssignmentState, CustomResourceOptions)

Get an existing Assignment resource's state with the given name, ID, and optional extra properties used to qualify the lookup.

Declaration
public static Assignment Get(string name, Input<string> id, AssignmentState state = null, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resulting resource.
Input<System.String> id

The unique provider ID of the resource to lookup.
AssignmentState state

Any extra arguments used during the lookup.
CustomResourceOptions options

A bag of options that control this resource's behavior
Returns
Type Description
Assignment