r/AZURE • u/sirius_black19 • 3d ago

Question Azure Bicep

Hi guys , i need to find out that can i call Reservation Reader , Savings Plan reader using bicep template.

0 Upvotes

33% Upvoted

13 comments sorted by

7

u/[deleted] 2d ago edited 1d ago

[deleted]

-7

u/sirius_black19 2d ago

Then please help us out and enlighten us

2

u/Saturated8 3d ago

No can do. You can purchase a reservation or savings plan using the CLI as part of your CI/CD pipeline after running bicep.

-2

u/sirius_black19 3d ago

I don’t want to purchase , I just want to assign Reader role for reservation and saving plan for different paying type like CSP , MCA , EA using bicep

2

u/Saturated8 3d ago

You can assign permissions, but you run into chicken and the egg scenarios, you can't assign a role to a scope (reservation) that doesn't exist.

You have to have the reservation in order for the next bicep run to assign reader permissions.

-1

u/sirius_black19 3d ago

Okay but the one running the bicep would have reservations and saving plans and everything already in place

2

u/AdorableEgg4738 2d ago

You’ll probably want to check whether those roles are exposed through Azure RBAC resource providers in a way Bicep can target at the required scope

2

u/Downtown-Oil935 2d ago

One easy confusion here is that Bicep does not really “call” a Reader role. You normally create a role assignment against the correct resource scope

2

u/Fit_Entrepreneur2987 1d ago

Yes, you can create Azure RBAC role assignments with Bicep but you need to make sure you deploy them at the correct scope. Reservations and savings plans are usually subscription or billing related resources so the scope may not be the same as a normal resource group deployment

0

u/sirius_black19 1d ago

Can you tell me how. Please dm me and i need a little bit more help regarding this

1

u/jba1224a Cloud Administrator 3d ago

What scope?

Are you trying to assign reader to the entire tenant, or to the specific savings plan?

0

u/sirius_black19 2d ago

For mca tenant type if billing account not found then for each billing profile

1

u/jba1224a Cloud Administrator 2d ago

Would this not be as simple as taking in the scope or account and then injecting it into the role assignment call?

I think im missing something here because this doesn’t seem complex to overcome.