Unable to use artifacts function to specify roleDefinitionId.

[oliverroer]

This article says that the roleDefinitionId on an artifact of kind roleAssignment cannot be parameterized.

As far as I can see, this means that something like the following will not work:

{
    "kind": "roleAssignment",
    "properties": {
        "description": "Assigns a custom role to a principal",
        "displayName": "Custom Role Assignment",
        "principalIds": [
            "[parameters('principal')]"
        ],
        "roleDefinitionId": "[artifacts('customRole').outputs.resourceId]"
    }
}

where the customRole artifact is of kind template and outputs a resourceId which is the resource ID of a custom role that it creates on the subscription.

As noted, I'm aware that this is not supported, however, I would like to hear the reason why, as I'm trying to create a blueprint that both created a custom role definition and assigns it at the same time.

It is probably be possible to do the assignment using ARM templating, however, I would like to avoid it, since doing role assignments in ARM is messy process that does not spark joy (see this issue).

[alex-frankel]

Basically we check that you have access to the role definition when you create the blueprint definition. We are not able to do that if it's parameterized. If you are not using the blueprint lock capability, then I'd recommend using bicep + template specs as this will give you full control to parameterize any field. You may want to check out this video:
https://www.youtube.com/watch?v=i4dEN0o1PHo

[oliverroer]

So there's an up-front check on the role definition when you create the blueprint definition, if I understood you correctly.
Have you considered doing this check during assignment/deployment instead?

Also yes, I do use the lock capability and intend to keep doing so. ☹️

I will have a look at the video later. 😄

[oliverroer]

I have now had a look at the video you linked. It looks like the Bicep approach has the same issue as ARM, as it is essentially just ARM with a nicer syntax and functionality. Having to come up with your own GUID for the role assignment is something we would like to avoid.