Nested loop in Bicep

Question

Im trying to assign multiple AD group to Multiple RBAC roles to my storage account.

So I need to Loop through my adGroup variable ( array) and then need to also loop all my RoleIDs to assign each of my adGroup.

My attempt is below code but file showing some error so 100% syntax error. Im new to bicep so would be appraciated some help

my definition to call module:

param adGroup array

module addGroups 'platform/modules/roles/aad group/deploy.bicep' = {
  name: 'datalake-rbac'
  params: {
    storageAccountName: storageAccountName
    adGroup: adGroup
    roleId: ['ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
             'b24988ac-6180-42a0-ab88-20f7382dd24c' // Contributor
  ]
  }
  dependsOn: [
    storageAccountModule

  ]
}

/////////////////////

param storageAccountName string
param addGroup array
param roleId array
param principalType string = 'Group'

// Reference to the storage account
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

// Flatten the loop into a single array using a combined `for` loop
resource roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for groupId in addGroup: for rId in roleId: {
  name: guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, groupId, rId)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', rId)
    principalId: groupId
    principalType: principalType
  }
}]

Try using a nested loop for roleAssignments and fix the roleId array with commas decalre as below roleId: ['roleId1', 'roleId2'] resource roleAssignments = [for groupId in adGroup: for rId in roleId: { /* Role Assignment */ }] — Vinay B
– Vinay B, Commented Nov 21, 2024 at 16:23

Thomas · Accepted Answer · 2024-11-21 19:08:33Z

Nested loops are not natively supported in bicep (see discussion). But you could always loop through the module

// storage-role-assignment.bicep
param storageAccountName string
param principalId string
param roleIds array
param principalType string = 'Group'

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

resource roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for roleId in roleIds: {
  name: guid(storageAccount.id, principalId, roleId)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleId)
    principalId: principalId
    principalType: principalType
  }
}]

Then you can invoke it like that

param adGroupIds array
param storageAccountName string

module groupAssignments 'storage-role-assignment.bicep' = [
  for adGroupId in adGroupIds: {
    name: 'datalake-rbac-${adGroupId}'
    params: {
      storageAccountName: storageAccountName
      principalId: adGroupId
      roleIds: [
        'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
        'b24988ac-6180-42a0-ab88-20f7382dd24c' // Contributor
      ]
    }
    dependsOn: [
      storageAccountModule
    ]
  }
]

Collectives™ on Stack Overflow

Nested loop in Bicep

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related