Aspire 9.4, CommunicationServices and removed AzureBicepResource.KnownParameters.PrincipalId?

[AndiRudi]

Some time ago we have added a custom Bicep File for Azure Communication Services. This does not work anymore after upgrade to Aspire 9.4 and I am not sure what to do?

Inside that bicep we need to specific the principalId

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: communicationService
  name: guid(resourceGroup().id, 'roleAssignmentCommunicationServices')
  properties: {
    roleDefinitionId: roleDefinition.id
    principalId: principalId
  }
}

Due to that we have passed that down from the Apphost:

  azureCommunicationServices = builder.AddBicepTemplate(name: "azureCommunicationServices", bicepFile: "./Bicep/AzureCommunicationServices.bicep")
        .WithParameter(AzureBicepResource.KnownParameters.PrincipalId);

After upgrading to Aspire 9.4 and adding AddAzureContainerAppEnvironment everything deploys fine except the Communication Services. The following error appears:

InvalidPrincipalId: A valid principal ID must be provided for role assignment.

When I understand correctly the well known parameter AzureBicepResource.KnownParameters.PrincipalId is obsolete and there is no way to get that principalId anymore...

What is the recommended way to fix this?

I have already tried AddAzureUserAssignedIdentity but then the deployment complains, that I cannot change the identity (RoleAssignmentUpdateNotPermitted: Tenant ID, application ID, principal ID, and scope are not allowed to be updated.)

Any help is appreciated.

[davidfowl]

@eerhardt This might be a gap. If you write a custom bicep resource, you can't participate in our role assignment infrastructure.

aspire/src/Aspire.Hosting.Azure/AzureProvisioningResource.cs

Lines 38 to 57 in ced7327

	public virtual ProvisionableResource AddAsExistingResource(AzureResourceInfrastructure infra) => throw new NotImplementedException();
	/// <summary>
	/// Adds role assignments to this Azure resource.
	/// </summary>
	/// <param name="roleAssignmentContext">The context containing information about the role assignments and what principal to use.</param>
	public virtual void AddRoleAssignments(IAddRoleAssignmentsContext roleAssignmentContext)
	{
	var infra = roleAssignmentContext.Infrastructure;
	var prefix = this.GetBicepIdentifier();
	var existingResource = AddAsExistingResource(infra);
	var principalType = roleAssignmentContext.PrincipalType;
	var principalId = roleAssignmentContext.PrincipalId;
	foreach (var role in roleAssignmentContext.Roles)
	{
	infra.Add(CreateRoleAssignment(prefix, existingResource, role.Id, role.Name, principalType, principalId));
	}
	}

Essentially, the role assignments are completely external to the resource, but the resource describes default role assignments. On a per edge (compute resource, azure resource) the user can override those default role assignments.

This works by the infrastructure calling AddRoleAssignments on the AzureProvisioningResource, which handles injecting the right principal...

You might be in luck:

https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/provisioning/Azure.Provisioning.Communication
https://www.nuget.org/packages/Azure.Provisioning.Communication/

Can you share your AzureCommunicationServices.bicep? You should be able to build a quick replacement for that resource while we work on this issue for the next version.

[eerhardt]

The problem is that there is no global "PrincipalId" any more. Instead, each compute app has their own. So you need to pick which projects have the role to your Azure resource.

Can you try something like this:

var apiService = builder.AddProject<Projects.ApiService>("apiservice");

  azureCommunicationServices = builder.AddBicepTemplate(name: "azureCommunicationServices", bicepFile: "./Bicep/AzureCommunicationServices.bicep")
        .WithParameter("principalId", () => 
        {
            if (apiService.Resource.TryGetLastAnnotation<AppIdentityAnnotation>(out var appIdentity))
            {
                return appIdentity.IdentityResource.PrincipalId;
            }
            throw new InvalidOperationException("Couldn't find an AppIdentityAnnotation.");
        });

[AndiRudi]

I tried this and it changes something...

Creating/Updating resources
You can view detailed progress in the Azure Portal:
(✓) Done: Resource group: rg-prod (2.197s)
(✓) Done: Storage account: (2.05s)
(✓) Done: Key Vault: postgreskv-(427ms)
(✓) Done: Key Vault: hangfirePostgreskv-(414ms)
(✓) Done: Log Analytics workspace: law-(21.909s)
(✓) Done: Container Registry: (1.307s)
(✓) Done: Storage account: (917ms)
(✓) Done: Container Apps Environment: cae-(17.961s)
(✓) Done: Azure Database for PostgreSQL flexible server: hangfirepostgres-(1m2.964s)
(✓) Done: Azure Database for PostgreSQL flexible server: postgres-(2m3.153s)
ERROR: deployment failed: error deploying infrastructure: deploying to subscription:
Deployment Error Details:
RoleAssignmentUpdateNotPermitted: Tenant ID, application ID, principal ID, and scope are not allowed to be updated.
TraceID: ac2e9f4f153584d5c383297a852ae861
Error: Process completed with exit code 1.

[davidfowl]

Run azd infra gen to see the generated bicep.

[AndiRudi]

Sure, here it is

param location string
param isProd bool
param principalId string

//Please note that before this deployment works, the domain needs to be provisioned and verified in azure email communication services. 
//This can only be done manually, so you can deploy and it will create everything, but there will be errors... then
//you have to verify the domain (status, spg, dkim, dkim2)

// Email Communication Service
resource emailService 'Microsoft.Communication/emailServices@2023-03-31' = {
  name: guid(resourceGroup().id, 'EmailServices')
  location: 'global'
  properties: {
    dataLocation: 'Europe'
  }
}

// Email Communication Services Domain (Azure Managed)
resource emailServiceAzureDomain 'Microsoft.Communication/emailServices/domains@2023-03-31' = if (!isProd) {
  parent: emailService
  name: 'AzureManagedDomain'
  location: 'global'
  properties: {
    domainManagement: 'AzureManaged'
    userEngagementTracking: 'Disabled'
  }
}

// SenderUsername (Azure Managed Domain)
resource senderUserNameAzureDomain 'Microsoft.Communication/emailServices/domains/senderUsernames@2023-03-31' = if (!isProd) {
  parent: emailServiceAzureDomain
  name: 'support'
  properties: {
    username: 'support'
    displayName: 'support'
  }
}

// Email Communication Services Domain (Customer Managed)
resource emailServiceCustomDomain 'Microsoft.Communication/emailServices/domains@2023-03-31' = if (isProd) {
  parent: emailService
  name: 'website.net'
  location: 'global'
  properties: {
    domainManagement: 'CustomerManaged '
    userEngagementTracking: 'Disabled'
  }
}

// SenderUsername (Customer Managed Domain)
resource senderUserNameCustomDomain 'Microsoft.Communication/emailServices/domains/senderUsernames@2023-03-31' = if (isProd) {
  parent: emailServiceCustomDomain
  name: 'support'
  properties: {
    username: 'support'
    displayName: 'support'
  }
}

// Link the correct domain based on the environment
var emailServiceResource = isProd ? emailServiceCustomDomain.id : emailServiceAzureDomain.id

// Communication Service
resource communicationService 'Microsoft.Communication/communicationServices@2023-03-31' = {
  name: guid(resourceGroup().id, '  CommunicationServices')
  location: 'global'
  properties: {
    dataLocation: 'Europe'
    linkedDomains: [
      emailServiceResource
    ]
  }
}


// See https://moimhossain.com/2023/09/05/azure-communication-service-with-managed-identity/ regarding use of managed identity with bicep

resource roleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
  name: 'b24988ac-6180-42a0-ab88-20f7382dd24c' //This is the built-in Contributor role. See https://docs.microsoft.com/azure/role-based-access-control/built-in-roles
}

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: communicationService
  name: guid(resourceGroup().id, 'roleAssignmentCommunicationServices')
  properties: {
    roleDefinitionId: roleDefinition.id
    principalId: principalId
  }
}

output communicationServicesUri string = communicationService.properties.hostName

[AndiRudi]

I found a workaround... I lookup the principal object id in the UI in Azure and manually specified it in the code. I know this is not very good, but at least we can deploy Aspire 9.4. I hope there is a solution soon to fix this or even better to have an aspire plugin for communications service. Thanks

[davidfowl]

Fine workaround for now, but we do need to solve this. Sorry for the inconvenience!