[Role] Add az role definition show command
#30593
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
️✔️AzureCLI-FullTest
|
|
Hi @jiasli, |
|
| rule | cmd_name | rule_message | suggest_message |
|---|---|---|---|
| role definition show | cmd role definition show added |
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
|
jiasli
changed the title
az role definition show command az role definition show command
jiasli
force-pushed
the
role-definition-show
branch
from
c34504d to
2fd55cd
Compare
jiasli
commented
Jan 13, 2025
| @@ -370,6 +370,14 @@ class PrincipalType(str, Enum): | |||
|
|
|||
| with self.argument_context('role definition') as c: | |||
| c.argument('role_definition_id', options_list=['--name', '-n'], help='the role definition name') | |||
| c.argument('role_id', options_list=['--id'], | |||
There was a problem hiding this comment.
The --ids argument provided by Azure CLI core relies on azure.mgmt.core.tools.parse_resource_id
which parses the resource ID into parts:
- subscription: Subscription id
- resource_group: Name of resource group
- namespace: Namespace for the resource provider (i.e. Microsoft.Compute)
- type: Type of the root resource (i.e. virtualMachines)
- name: Name of the root resource
- child_namespace_{level}: Namespace for the child resource of that level
- child_type_{level}: Type of the child resource of that level
- child_name_{level}: Name of the child resource of that level
- last_child_num: Level of the last child
- resource_parent: Computed parent in the following pattern: providers/{namespace}\
/{parent}/{type}/{name}
- resource_namespace: Same as namespace. Note that this may be different than the \
target resource's namespace.
- resource_type: Type of the target resource (not the parent)
- resource_name: Name of the target resource (not the parent)
However, it can't parse scope, so we have to define our own --id.
jiasli
force-pushed
the
role-definition-show
branch
from
7d172d3 to
149c614
Compare
jiasli
force-pushed
the
role-definition-show
branch
from
149c614 to
1758442
Compare
jiasli
commented
Jan 16, 2025
Comment on lines
+77
to
+78
| if not role_id and not (name and scope): | ||
| raise CLIError('Usage error: Provide both --scope and --name') |
There was a problem hiding this comment.
--scope should be a required argument to align with az role assignment create and az ad sp create-for-rbac.
Also see
evelyn-ys
approved these changes
Jan 16, 2025
bebound
approved these changes
Jan 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related command
az role definition showDescription
For
az role definition list, #30587 started to useroleNamefilter when--nameis a non-GUID string, but if the provided--nameis a GUID, this command still uses a client-side filter which is inefficient.namecannot be used as afilterand the API fails with:We can internally switch to Role Definitions - Get API when
--nameis a GUID and convert the result to a list, but this introduces complexity withinaz role definition listcommands, as it will have 2 code paths and need to handle 404 error returned by the Role Definitions - Get API.Having a dedicated
az role definition showcommand is more consistent with other Azure CLI commands and the underlying REST API.Testing Guide