[RBAC] Issues with Role Definition commands

The role definition commands work very poorly and are extremely unreliable.

If I run the following:

az role definition create --role-definition @myrole.json
az role definition delete -n my-custom-role

Now when I run az role definition list -n my-custom-role multiple times, I get very unpredictable results. Sometimes I get nothing, implying the delete succeeded. Other times I get something, implying the delete failed.

Also, if I run az role definition delete -n my-custom-role multiple times, there are three scenarios:

1. It will appear to work because the internal list operation returns nothing
2. It will appear to work because the internal list operation returns something and the delete operation succeeds.
3. It will appear to fail because the internal list operation returns something and the delete operation returns with a 204 response code which is interpreted by the SDK as a CloudError.

---

Environment summary

Install Method: How did you install the CLI? (e.g. pip, interactive script, apt-get, Docker, MSI, nightly)
Answer here: dev_setup.py

CLI Version: What version of the CLI and modules are installed? (Use az --version)
Answer here: latest master

OS Version: What OS and version are you using?
Answer here: Win10CU

Shell Type: What shell are you using? (e.g. bash, cmd.exe, Bash on Windows)
Answer here: cmd.exe

[jboeshart]

I see the same delay on az role definition create as well. I can run it, then run az role definition list with the name of the role I just created and it comes back with nothing. Not sure how to handle this on the back end, but is a poor end user experience.

The output from the create command also does not line up with the actual JSON in the definition file as well, making it harder to troubleshoot. Will log a separate issue on this though.

[jiasli]

There is no fancy logic in delete_role_definition:

https://github.com/Azure/azure-cli/blob/5edbd822ee860d7ba5d5182811b68233e0846ba8/src/azure-cli/azure/cli/command_modules/role/custom.py#L107-L114

This AD Graph latency is by-design and there is no plan on the service side to improve it. As a workaround, the script can use az role definition list to query on the result and take actions accordingly.