Skip to content

Allow roleDefinitions in resource ID lint rule #19888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nkgotcode wants to merge 2 commits into
base: main
Choose a base branch
from
+30 −8
Open

Allow roleDefinitions in resource ID lint rule #19888

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bd23a0e
Allow roleDefinitions in resource ID lint rule
nkgotcode Jun 15, 2026
2687fa6
Update InvalidResources CRLF diagnostics baseline
nkgotcode Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion src/Bicep.Core.UnitTests/Diagnostics/LinterRuleTests/UseResourceIdFunctionsRuleTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ namespace Bicep.Core.UnitTests.Diagnostics.LinterRuleTests
[TestClass]
public class UseResourceIdFunctionsRuleTests : LinterRuleTestsBase
{
private const string allowedFunctions = "extensionResourceId, guid, if, managementGroupResourceId, reference, resourceId, subscription, subscriptionResourceId, tenantResourceId";
private const string allowedFunctions = "extensionResourceId, guid, if, managementGroupResourceId, reference, resourceId, roleDefinitions, subscription, subscriptionResourceId, tenantResourceId";

private static void CompileAndTest(string bicep, params string[] expectedMessages)
{
Expand Down Expand Up @@ -1973,6 +1973,22 @@ param parTopLevelManagementGroupParentId string
}
}
}
",
expectedMessages: []);
}

[TestMethod]
public void RoleDefinitionFunctionPropertyAccessShouldPass()
{
CompileAndTest(
@"
resource sample 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: '00000000-0000-0000-0000-000000000000'
properties: {
roleDefinitionId: roleDefinitions('Monitoring Metrics Publisher').id
principalId: '00000000-0000-0000-0000-000000000000'
}
}
",
expectedMessages: []);
}
Expand Down
12 changes: 9 additions & 3 deletions src/Bicep.Core/Analyzers/Linter/Rules/UseResourceIdFunctionsRule.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ public UseResourceIdFunctionsRule() : base(
"managementGroupResourceId",
"reference",
"resourceId",
"roleDefinitions",
"subscription",
"subscriptionResourceId",
"tenantResourceId",
Expand Down Expand Up @@ -265,6 +266,14 @@ private static ResourceIdStatus IsResourceIdProperty(ObjectPropertySyntax Proper
return null;
}
break;
case AccessExpressionSyntax accessExpression:
if (IsParameterPropertyAccess(model, accessExpression))
{
// parameter properties are always okay
return null;
}

return AnalyzeIdPropertyValue(model, propertySyntax, accessExpression.BaseExpression, currentPaths);
case VariableAccessSyntax: // Variable and parameter access
if (model.GetSymbolInfo(expression) is DeclaredSymbol symbol)
{
Expand All @@ -286,9 +295,6 @@ private static ResourceIdStatus IsResourceIdProperty(ObjectPropertySyntax Proper
}
}
break;
case AccessExpressionSyntax accessExpression when IsParameterPropertyAccess(model, accessExpression):
// parameter properties are always okay
return null;
case TernaryOperationSyntax:
// "if"/ternary is acceptable
return null;
Expand Down
Loading