Azure CLI流水线部署Bicep时遇InvalidOperationString错误排查

在Azure DevOps流水线中通过Azure CLI执行Bicep模板，尝试创建资源组并为订阅分配角色时，触发DeploymentFailed错误，具体错误为InvalidOperationString：“Invalid operation string {subscription_name} provided in request”。

错误详情 #

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/{subscription_id}/providers/Microsoft.Resources/deployments/assign_role_to_subscription","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidOperationString","message":"Invalid operation string {subscription_name} provided in request"}]}}

涉事Bicep模板 #

import * as common from 'exports.bicep'
targetScope='subscription'

//  Parameters
param resourceGroupName string = 'rg-ascend-us'
param resourceGroupLocation string = 'eastus2'
param environmentName string = 'Development'

var peregrineGroupPrincipalId = '{group_principal_id}'
var readerRoleDefinitionId = 'acdd72a7-3385-48ef-bd42-f606fba81ae7'
var subscriptionName = 'Cosmos Dev'

//  Get existing subscription
@description('')
resource subscriptionResource 'Microsoft.Subscription/subscriptionOperations@2017-11-01-preview' existing = {
  scope: tenant()
  name: subscriptionName
}

//  Get the reader role.
@description('This is the built-in Reader role. See acdd72a7-3385-48ef-bd42-f606fba81ae7')
resource readerRoleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
  scope: subscription()
  name: readerRoleDefinitionId
}

//  Assign group 'sg-apac-peregrine' to the subscription and set the role.
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: subscriptionResource
  name: guid(subscription().id, peregrineGroupPrincipalId, readerRoleDefinition.id)
  properties:{
    roleDefinitionId: readerRoleDefinition.id
    principalId: peregrineGroupPrincipalId
    principalType: 'Group'
  }
}

resource resourceGroup 'Microsoft.Resources/resourceGroups@2024-03-01' = {
  name: resourceGroupName
  location: resourceGroupLocation
  tags: common.getTags(environmentName)
}

流水线Azure CLI任务配置 #

- task: AzureCLI@2
  inputs:
    azureSubscription: 'Azure Cosmos Dev Subscription Connection'
    scriptType: bash
    scriptLocation: inlineScript
    useGlobalConfig: false
    inlineScript: |
      az deployment sub create --location eastus2 --template-file $(System.DefaultWorkingDirectory)/.iac/bicep/assign_role_to_subscription.bicep

执行的CLI命令：

az deployment sub create --location eastus2 --template-file {path_to_bicep_file}

• 修正订阅资源引用类型：Bicep中错误使用了Microsoft.Subscription/subscriptionOperations资源类型来引用现有订阅，该类型用于订阅操作（如取消、重命名），并非用来引用订阅本身。要引用订阅，直接使用subscription()函数即可，无需额外声明subscriptionResource资源。
• 调整角色分配的作用域：原模板中角色分配的作用域指向错误的subscriptionResource，应直接使用subscription()作为作用域；由于模板targetScope已设为subscription，也可省略作用域声明，默认作用域即为当前部署的订阅。
• 验证订阅引用规则：若需跨订阅引用其他订阅，需使用正确的资源类型Microsoft.Subscription/subscriptions@2020-09-01，且name字段必须填写订阅ID而非订阅显示名称——ARM资源体系中，订阅资源的名称是其ID，不是自定义显示名。
• 简化模板逻辑：当前流水线服务连接已关联目标订阅，部署本身就是针对该订阅，可直接删除subscriptionResource的声明，将角色分配资源简化为：

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(subscription().id, peregrineGroupPrincipalId, readerRoleDefinition.id)
  properties:{
    roleDefinitionId: readerRoleDefinition.id
    principalId: peregrineGroupPrincipalId
    principalType: 'Group'
  }
}

内容的提问来源于stack exchange，提问作者Vinit Divekar