Deployment fails with authorisation error

[philipstreet]

🐛 Problem

Deployment fails with authorisation error.

👣 Repro steps

TODO: Add repro steps below:

1. Go to https://microsoft.github.io/finops-toolkit/hubs#deploy
2. Click on "Deploy to Azure"
3. Provide following parameters:

• Resource Group: [choose existing or create new]
• Hub name: finops-hub
• Cluster name: [a unique cluster name]
• Use defaults for rest of input parameters.

5. See error;

{"code":"DeploymentFailed","target":"/subscriptions/1927d2bd-fd97-41a7-afda-c35dfe0db374/resourceGroups/rg-pas-finops-v11-poc-2nd/providers/Microsoft.Resources/deployments/hub","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidTemplateDeployment","message":"The template deployment failed with error: 'Authorization failed for template resource '444f14ac-d621-5198-8d6b-4f53e5939af2' of type 'Microsoft.Authorization/roleAssignments'. The client 'xxxxxxx@xxxxxxx' with object id 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/1927d2bd-fd97-41a7-afda-c35dfe0db374/resourceGroups/rg-pas-finops-v11-poc-2nd/providers/Microsoft.Storage/storageAccounts/finopshubkuedu6c2rwubs/providers/Microsoft.Authorization/roleAssignments/444f14ac-d621-5198-8d6b-4f53e5939af2'.'."}]}

🤔 Expected

Successful deployment.

ℹ️ Additional context

• I have Owner permissions on the Subscription.
• I do not want to use the managed cost reports exports feature.

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Leave comments to help us solidify the vision.

[gajendrakyndryl]

Generally this error encounter when you do not have correct access. You may check your access once. Also, if you have owner access, check if this come with condition. You may need to get rid of those conditions.

[philipstreet]

I discussed this issue on a Teams call with @flanakin last week, where it is was found that the current ARM template assumes that a role assignment is required to allow the configuration of managed cost exports. Removing the role assignment from the template allowed the deployment to succeed. This issue was raised so that Michael can link a feature change to remove the assumed role assignment from the ARM template.

[flanakin]

We'll make managed exports optional. That should resolve this.