diff --git a/src/azure-cli/azure/cli/command_modules/vm/_help.py b/src/azure-cli/azure/cli/command_modules/vm/_help.py index fd3e7e9185b..3cd250eccc6 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_help.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_help.py @@ -1450,7 +1450,7 @@ --image debian --secrets "$vm_secrets" - name: Create a CentOS VM with a system assigned identity. The VM will have a 'Contributor' role with access to a storage account. text: > - az vm create -n MyVm -g rg1 --image centos --assign-identity [system] --scope /subscriptions/99999999-1bf0-4dda-aec3-cb9272f09590/MyResourceGroup/myRG/providers/Microsoft.Storage/storageAccounts/storage1 + az vm create -n MyVm -g rg1 --image centos --assign-identity [system] --scope /subscriptions/99999999-1bf0-4dda-aec3-cb9272f09590/MyResourceGroup/myRG/providers/Microsoft.Storage/storageAccounts/storage1 --role Contributor - name: Create a debian VM with a user assigned identity. text: > az vm create -n MyVm -g rg1 --image debian --assign-identity /subscriptions/99999999-1bf0-4dda-aec3-cb9272f09590/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID @@ -2820,7 +2820,7 @@ --image debian --secrets "$vm_secrets" - name: Create a VM scaleset with system assigned identity. The VM will have a 'Contributor' Role with access to a storage account. text: > - az vmss create -n MyVmss -g MyResourceGroup --image centos --assign-identity --scope /subscriptions/99999999-1bf0-4dda-aec3-cb9272f09590/MyResourceGroup/myRG/providers/Microsoft.Storage/storageAccounts/storage1 + az vmss create -n MyVmss -g MyResourceGroup --image centos --assign-identity --scope /subscriptions/99999999-1bf0-4dda-aec3-cb9272f09590/MyResourceGroup/myRG/providers/Microsoft.Storage/storageAccounts/storage1 --role Contributor - name: Create a debian VM scaleset with a user assigned identity. text: > az vmss create -n MyVmss -g rg1 --image debian --assign-identity /subscriptions/99999999-1bf0-4dda-aec3-cb9272f09590/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID diff --git a/src/azure-cli/azure/cli/command_modules/vm/_params.py b/src/azure-cli/azure/cli/command_modules/vm/_params.py index 6f2a4188424..7a538d3992d 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_params.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_params.py @@ -1008,9 +1008,19 @@ def load_arguments(self, _): with self.argument_context(scope) as c: arg_group = 'Managed Service Identity' if scope.split()[-1] == 'create' else None c.argument('identity_scope', options_list=['--scope'], arg_group=arg_group, help="Scope that the system assigned identity can access") - c.argument('identity_role', options_list=['--role'], arg_group=arg_group, help="Role name or id the system assigned identity will have") c.ignore('identity_role_id') + for scope in ['vm create', 'vmss create']: + with self.argument_context(scope) as c: + c.argument('identity_role', options_list=['--role'], arg_group='Managed Service Identity', + help='Role name or id the system assigned identity will have. ' + 'Please note that the default value "Contributor" will be removed in the future, ' + "so please specify '--role' and '--scope' at the same time when assigning a role to the managed identity") + + for scope in ['vm identity assign', 'vmss identity assign']: + with self.argument_context(scope) as c: + c.argument('identity_role', options_list=['--role'], help="Role name or id the system assigned identity will have") + with self.argument_context('vm auto-shutdown') as c: c.argument('off', action='store_true', help='Turn off auto-shutdown for VM. Configuration will be cleared.') c.argument('email', help='The email recipient to send notifications to (can be a list of semi-colon separated email addresses)') diff --git a/src/azure-cli/azure/cli/command_modules/vm/_validators.py b/src/azure-cli/azure/cli/command_modules/vm/_validators.py index bd6b3376577..d239a68f4bb 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_validators.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_validators.py @@ -1213,20 +1213,31 @@ def _validate_vm_vmss_msi(cmd, namespace, from_set_command=False): identities[i] = _get_resource_id(cmd.cli_ctx, identities[i], namespace.resource_group_name, 'userAssignedIdentities', 'Microsoft.ManagedIdentity') if not namespace.identity_scope and getattr(namespace.identity_role, 'is_default', None) is None: - raise CLIError("usage error: '--role {}' is not applicable as the '--scope' is not provided".format( - namespace.identity_role)) + raise ArgumentUsageError("usage error: '--role {}' is not applicable as the '--scope' is not provided". + format(namespace.identity_role)) user_assigned_identities = [x for x in identities if x != MSI_LOCAL_ID] if user_assigned_identities and not cmd.supported_api_version(min_api='2017-12-01'): - raise CLIError('usage error: user assigned identity is only available under profile ' - 'with minimum Compute API version of 2017-12-01') + raise ArgumentUsageError('usage error: user assigned identity is only available under profile ' + 'with minimum Compute API version of 2017-12-01') if namespace.identity_scope: if identities and MSI_LOCAL_ID not in identities: - raise CLIError("usage error: '--scope'/'--role' is only applicable when assign system identity") + raise ArgumentUsageError("usage error: '--scope'/'--role' is only applicable when " + "assign system identity") # keep 'identity_role' for output as logical name is more readable setattr(namespace, 'identity_role_id', _resolve_role_id(cmd.cli_ctx, namespace.identity_role, namespace.identity_scope)) elif namespace.identity_scope or getattr(namespace.identity_role, 'is_default', None) is None: - raise CLIError('usage error: --assign-identity [--scope SCOPE] [--role ROLE]') + raise ArgumentUsageError('usage error: --assign-identity [--scope SCOPE] [--role ROLE]') + + # For the creation of VM and VMSS, the default value "Contributor" of "--role" will be removed in the future. + # Therefore, the first step is to prompt users that parameters "--role" and "--scope" should be passed in + # at the same time to reduce the impact of breaking change + if not from_set_command and namespace.identity_scope and getattr(namespace.identity_role, 'is_default', None): + logger.warning( + "Please note that the default value of parameter '--role' will be removed in the future. " + "So specify '--role' and '--scope' at the same time when assigning a role to the managed identity " + "to avoid breaking your automation script when the default value of '--role' is removed." + ) def _validate_vm_vmss_set_applications(cmd, namespace): # pylint: disable=unused-argument