[AVM Question/Feedback]: managed identity/RBAC dependency loop after AVM migration

[sinedied]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Description

My app create resources (ie SWA, Functions API, Cosmos DB, OpenAI), and Managed Identity/RBAC creates cross dependencies, for example:

• Functions needs Cosmos DB endpoint as env var
• Cosmos DB needs Functions principal ID to set up SQL roles

Before AVM I was fine, as I set up these in 3 resources:

• Functions, with a dependency on Cosmos DB for endpoint output for app settings (env vars)
• Cosmos DB
• SQL Role, with a dependency on both Functions (principalId) and Cosmos DB (account name)

But migrating to AVM I'm stuck, because the SQL role can only be set up as part of Cosmos DB module and not separately (its a cosmos submodule that cannot be accessed directly, as stated in AVM FAQ).
Now I have a dependency loop that I cannot solve, using only AVM modules.

Is there an obvious way to solve this that I missed?

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[AlexanderSehr]

Hey @sinedied,
from the top of my head I'd probably advice to run the role assignment separately as you did originally in the last step using a raw RBAC deployment. It's not pretty, but I don't see how the modules could solve this issue without implementing specific code for this use case (i.e., Cosmos + Function App).
I take it the Cosmos Endpoint is not deterministic? I.e. it would not be possible to construct it and as such resolve one dependency?

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.

[microsoft-github-policy-service]

Important

@sinedied, this issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.

Tip

To prevent further actions to take effect, one of the following conditions must be met:

• The author must respond in a comment within 3 days of this comment.
• The "Status: No Recent Activity 💤" label must be removed.
• If applicable, the "Status: Long Term ⏳" or the "Needs: Module Owner 📣" label must be added.

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.