Иногда шаблон ARM генерирует ошибку PrincipalNotFound при работе с назначенным пользователем управляемым удостоверением

Question

Итак, я пытаюсь сделать следующее с шаблоном ARM:

1. Создать новое назначенное пользователем управляемое удостоверение (my-managed-identity) в группе ресурсов my-rg
2. Назначьте my-managed-identity роль Reader для my-rg
3. Назначьте роль Managed Identity Operator Принципалу обслуживания AKS (my-aks-sp) в my-managed-id

Здесь мой шаблон ARM для этого:

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "aksServicePrincipalObjectId": {
            "type": "string",
            "metadata": {
                "description": "The Object Id for the AKS Cluster Service Principal"
            }
        },
    },
    "variables": {
        "managedIdentityName": "my-managed-identity",
        "readerRole": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
        "managedIdOperatorRole": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'f1a07417-d97a-45cb-824c-7a7467783830')]"
    },
    "resources": [
        {
            "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
            "name": "[variables('managedIdentityName')]",
            "apiVersion": "2018-11-30",
            "location": "[resourceGroup().location]",
            "resources": [
                {
                    "type": "Microsoft.ManagedIdentity/userAssignedIdentities/providers/roleAssignments",
                    "name": "[concat(variables('managedIdentityName'), '/Microsoft.Authorization/', guid(parameters('aksServicePrincipalObjectId')))]",
                    "apiVersion": "2018-09-01-preview",
                    "location": "[resourceGroup().location]",
                    "dependsOn": [
                        "[concat('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]"
                    ],
                    "properties": {
                        "roleDefinitionId": "[variables('managedIdOperatorRole')]",
                        "principalId": "[parameters('aksServicePrincipalObjectId')]"
                    }
                }
            ]
        },
        {
            "type": "Microsoft.Authorization/roleAssignments",
            "name": "[guid(variables('managedIdentityName'))]",
            "apiVersion": "2018-09-01-preview",
            "dependsOn": [
                "[concat('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]"
            ],
            "properties": {
                "roleDefinitionId": "[variables('readerRole')]",
                "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('managedIdentityName')),'2018-11-30').principalId]"
            }
        }
    ]
}

Странно то, что иногда это развертывание не работает. Я чаще всего получаю сообщение об ошибке:

New-AzResourceGroupDeployment : 2:56:07 PM - Resource Microsoft.Authorization/roleAssignments 'd62bb9a1-bf0b-5a92-aca1-74beab087ee9' failed with message '{
  "error": {
    "code": "PrincipalNotFound",
    "message": "Principal fad453d06bd042148411606b74525ed2 does not exist in the directory 936529098-bafa-4c91-b54f-f012cc11eeec."
  }
}

Я что-то здесь упускаю?

Answer 1

Эта документация от Microsoft решила мою проблему.

Вот мой полный шаблон:

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "aksServicePrincipalObjectId": {
            "type": "string",
            "metadata": {
                "description": "The Object Id for the AKS Cluster Service Principal"
            }
        },
    },
    "variables": {
        "managedIdentityName": "my-managed-identity",
        "readerRole": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
        "managedIdOperatorRole": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'f1a07417-d97a-45cb-824c-7a7467783830')]"
    },
    "resources": [
        {
            "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
            "name": "[variables('managedIdentityName')]",
            "apiVersion": "2018-11-30",
            "location": "[resourceGroup().location]",
            "resources": [
                {
                    "type": "Microsoft.ManagedIdentity/userAssignedIdentities/providers/roleAssignments",
                    "name": "[concat(variables('managedIdentityName'), '/Microsoft.Authorization/', guid(parameters('aksServicePrincipalObjectId')))]",
                    "apiVersion": "2018-09-01-preview",
                    "location": "[resourceGroup().location]",
                    "dependsOn": [
                        "[concat('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]"
                    ],
                    "properties": {
                        "roleDefinitionId": "[variables('managedIdOperatorRole')]",
                        "principalId": "[parameters('aksServicePrincipalObjectId')]",
                        "principalType": "ServicePrincipal" // This solved my issue
                    }
                }
            ]
        },
        {
            "type": "Microsoft.Authorization/roleAssignments",
            "name": "[guid(variables('managedIdentityName'))]",
            "apiVersion": "2018-09-01-preview",
            "dependsOn": [
                "[concat('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]"
            ],
            "properties": {
                "roleDefinitionId": "[variables('readerRole')]",
                "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('managedIdentityName')),'2018-11-30').principalId]",
                "scope": "[resourceGroup().id]" //This is what I added to get it to work! 
            }
        }
        ]

}