Role Assignment for User Assigned Identity doesn't work with Storage Accounts.

@ninjarobot this might be one for you to help with!

In Farmer 1.3 we’ve moved over to using the explicit roleAssignments resource. Here’s an example from a newly-generated template that is running over a storage account:

    {
      "apiVersion": "2020-04-01-preview",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', 'xxx')]"
      ],
      "name": "xxx",
      "properties": {
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'xxx')).principalId]",
        "principalType": "ServicePrincipal",
        "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'xxx')]",
        "scope": "[resourceId('Microsoft.Storage/storageAccounts', 'xxx')]"
      },
      "type": "Microsoft.Authorization/roleAssignments"
    }

It doesn’t work - here’s a (redacted) error message

The request to create role assignment 'xxx' is not valid. Role assignment scope '/subscriptions/xxx/resourceGroups/my-resource-group-name/providers/Microsoft.Storage/storageAccounts/xxx' must match the scope specified on the URI '/subscriptions/xxx/resourcegroups/xxx'.\

1.2 used the storage account role provider:

    {
      "apiVersion": "2018-09-01-preview",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', 'xxx')]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'xxx')]"
      ],
      "name": "xxx/Microsoft.Authorization/xxx",
      "properties": {
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'xxx')).principalId]",
        "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'xxx')]"
      },
      "tags": {
        "displayName": "StorageBlobDataReader (xxx)"
      },
      "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments"
    }

The main difference that I can see is that the new one adds scope and principal type. I suspect that either the extra fields added (scope / principaltype) are stopping things working. What do you think?

[ninjarobot]

Taking a look now, sorry I’ve been afk for a couple days.

[isaacabraham]

I’ve created a PR for this. @ninjarobot if you get five minutes, can you just scan through to check I’ve not screwed up something? Cheers.