PrincipalNotFound when using policyAssignments

[kevinpz]

Description

Hi!

I've a customer which is trying to use the policyAssignments module to assign a policy with a RBAC.
Each time they try to assign a policy, the bicep module doesn't found the principal and ends up in error the first time.
After they restart the pipeline a few minutes later everything is fine.

Steps to reproduce

1. Assign a policy which needs a RBAC
2. The deployment ends in error with the message: PrincipalNotFound: Principal xxxxx does not exist in the directory yyyyy
3. Restart the deployment a few minutes later, everything is fine

Thanks!

[ahmadabdalla]

@kevinpz , this sometimes happens when AAD DB sync may have some delay when being queried for the same principal ID that has been created for the system managed identity for the policy. There should be a retry mechanism that attempts to redeploy when this happens and usually is successful on the next run. Can you please check if the logs for the deployment contains:

VERBOSE: Resource deployment Failed.. (1/3) Retrying in 5 Seconds.. 

[shanhyland]

Hello @ahmadabdalla ,
I'm working with @kevinpz on the issue, I've checked the logs and it doesn't contain
VERBOSE: Resource deployment Failed.. (1/3) Retrying in 5 Seconds..

Could you give us more details on how to implement a retry nechanism?
Thanks

[ahmadabdalla]

I am not sure what deployment mechanism you're using. The current pipelines use this script to deploy resources, which we've added a retry mechanism in there, set to 3 times as default.

If you're using a fork for testing, please let me know the link so I can have a look as well :)

[shanhyland]

Hello @ahmadabdalla,
Our deployement pipeline are yml file with Stages and Job, which call bicep files that then call the modules in the arm folder, which seems to be really different than the powershell script you're using.

Using YAML pipeline with Stage and Jobs, is there a way to add a retry on fail mechanism?
Here's an exemple of what our pipeline looks like:

parameters:
- name: NameOfServiceConnection
  type: string
  default: ""
- name: scope
  type: string
  default: 'sub'
- name: location
  type: string
  default: 'TheRegion'
- name: environment
  type: string
  default: 'dev'
- name: templateFile
  type: string
  default: './.pipelines/test/main.bicep'
- name: mgmtGroupId
  type: string
  default: ''

stages:
  - stage: Validate_Bicep_Stage_${{ replace(replace(parameters.environment, '/', '_'), '-', '_') }}
    dependsOn: []
    displayName: "Validate [${{ parameters.environment }}]"
    jobs:
      - job: Validate_Bicep_Job
        timeoutInMinutes: 180
        displayName: "Validate Bicep [${{ parameters.environment }}]"
        steps:
        - checkout: self
        - template: ${{ parameters.scope }}.yml # Template reference
          parameters:
            action: 'validate'
            environment: ${{ parameters.environment }}
            azureServiceConnection: ${{ parameters.NameOfServiceConnection}}
            location: ${{ parameters.location }}
            templateFile: ${{ parameters.templateFile }}
            mgmtGroupId: ${{ parameters.mgmtGroupId }}
      - job: What_If_Bicep_Job
        timeoutInMinutes: 180
        displayName: "What-If Bicep [${{ parameters.environment }}]"
        steps:
        - checkout: self
        - template: ${{ parameters.scope }}.yml # Template reference
          parameters:
            action: 'what-if'
            environment: ${{ parameters.environment }}
            azureServiceConnection: ${{ parameters.NameOfServiceConnection}}
            location: ${{ parameters.location }}
            templateFile: ${{ parameters.templateFile }}
            mgmtGroupId: ${{ parameters.mgmtGroupId }}
  - stage: Create_Bicep_Stage_${{ replace(replace(parameters.environment, '/', '_'), '-', '_') }}
    displayName: "Create [${{ parameters.environment }}]"
    dependsOn:
      - Validate_Bicep_Stage_${{ replace(replace(parameters.environment, '/', '_'), '-', '_') }}
    condition: and(succeeded(), eq(variables['Build.SourceBranchName'], 'main'))
    jobs:
      - deployment: Create_Bicep_Job
        timeoutInMinutes: 180
        displayName: "Create Bicep Job [${{ parameters.environment }}]"
        environment: ${{ parameters.environment }}
        strategy:
          runOnce:
            deploy:
              steps:
              - checkout: self
              - template: ${{ parameters.scope }}.yml # Template reference
                parameters:
                  action: 'create'
                  environment: ${{ parameters.environment }}
                  azureServiceConnection: ${{ parameters.NameOfServiceConnection}}
                  location: ${{ parameters.location }}
                  templateFile: ${{ parameters.templateFile }}
                  mgmtGroupId: ${{ parameters.mgmtGroupId }}

[ahmadabdalla]

The template:

template: ${{ parameters.scope }}.yml # Template reference

Is that using a Powershell task within it to deploy? What I can think of at the top of my head is implementing a duplicate step that uses a condition Example

condition: and(failed(), eq(variables['Build.SourceBranchName'], 'main'))

which may work as a retry. I haven't tested this obviously, but it is a task that runs on failure, but not sure if that'll fail the pipeline if the previous step already failed.

[shanhyland]

Hello @ahmadabdalla ,
To your question: "Is that using a Powershell task within it to deploy?", the anser is no.
The Yaml file we have is calling a bicep file, and that bicep file is calling the modules in the arm folder.
So anyway to specify a retry step in our YAML pipeline files, that use Stage, Jobs, etc?

[ahmadabdalla]

@shanhyland , have a look at this guidance and see if you can add that to the task?

[mmMantas]

have you tried to set principalType to ServicePrincipal ?

[ahmadabdalla]

@azMantas , thank you and great suggestion and similar on role-assignments. I've added this to the policy assignments module - role assignments and will raise a PR accordingly.