Question 108678 in Ubuntu Question posted in
The official Ubuntu documentation can be found here.

Ubuntu – Creating Azure Resource Group (or Azure ML workspace) permission denied using GitHub action and Azure CLI

I have created a service principal on Azure with contributor permissions, and pasted it in github secrets.
Then, I created my workflow in .github.workflow directory in the project. I am trying to create the resources I need on azure using Azure CLI commands in github action, I want to create resource group, ML workspace, compute cluster, upload dataset, then run an ML job.

once I check the logs on github repo -> actions, I get the following message:

Run az ml workspace create –name "workspace_name" –resource-group ""resource_group_name
Class ManagedNetwork: This is an experimental class, and may change at any time. Please see https://aka.ms/azuremlexperimental for more information.

ERROR: (InvalidTemplateDeployment) Deployment failed with multiple errors: ‘Authorization failed for template resource ‘DeployResourceGroup-000000’ of type ‘Microsoft.Resources/deployments’. The client ‘00000’ with object id ‘00000/deployments/write’ at scope ‘/subscriptions/00000/providers/Microsoft.Resources/deployments/DeployResourceGroup-00000’.:Authorization failed for template resource ‘DeployLogWorkspace-00000’ of type ‘Microsoft.Resources/deployments’. The client ‘00000’ with object id ‘00000’ does not have permission to perform action ‘Microsoft.Resources/deployments/write’ at scope ‘/subscriptions/0000/resourceGroups/DefaultResourceGroup-francecentral/providers/Microsoft.Resources/deployments/DeployLogWorkspace-000000′.’

Message: Deployment failed with multiple errors: ‘Authorization failed for template resource ‘DeployResourceGroup-000000’ of type ‘Microsoft.Resources/deployments’. The client ‘00000’ with object id ‘00000’ does not have permission to perform action ‘Microsoft.Resources/deployments/write’ at scope ‘/subscriptions/0000/providers/Microsoft.Resources/deployments/DeployResourceGroup-000000’.:Authorization failed for template resource ‘DeployLogWorkspace-000000’ of type ‘Microsoft.Resources/deployments’. The client ‘00000’ with object id ‘00000’ does not have permission to perform action ‘Microsoft.Resources/deployments/write’ at scope ‘/subscriptions/00000/resourceGroups/DefaultResourceGroup-francecentral/providers/Microsoft.Resources/deployments/DeployLogWorkspace-000000′.’

here is the yaml file details:

name: Manually trigger an Azure Machine Learning job

on:
  workflow_dispatch:
    inputs:
      resource_group:
        description: resource group name
        required: true
        default: def_resource_group
        type: string
      region:
        description: region of resource group
        required: true
        default: francecentral
        type: string
      workspace:
        description: workspace name
        required: true
        default: workspace2
        type: string
      instance_name:
        description: compute instance name
        required: true
        default: def-cluster
        type: string
  
jobs:
  build_env_and_train:
    runs-on: ubuntu-latest
    steps:
    - name: Check out repo
      uses: actions/checkout@main
    - name: Install az ml extension
      run: az extension add -n ml -y
    - name: Azure login
      uses: azure/login@v1
      with:
        creds: ${{secrets.AZURE_CREDENTIALS}}
    - name: create a resource group on Azure
      uses: Azure/CLI@v1
      with:
        inlineScript: |
          #!/bin/bash
          if $(az group exists --name ${{ github.event.inputs.resource_group }}) ; then
            echo "Azure resource group already exists, skipping creation..."
          else
            az group create --name ${{ github.event.inputs.resource_group }} --location ${{ github.event.inputs.region }}
            az configure --defaults group=${{ github.event.inputs.resource_group }}
            echo "Azure resource group created"
          fi
          if $(az workspace exists --name ${{ github.event.inputs.workspace }}); then
            echo "workspace already exists with this name"
          else
            az ml workspace create --name ${{ github.event.inputs.workspace }}
            az configure --defaults workspace=${{ github.event.inputs.workspace }}
            echo "done! workspace is created"
          fi

It seems to be a syntax problem (from the error name). However, I looked for examples online and copy pasted their workflow yaml file and it gave me the same issue.

Note0: Azure login works.

Note1: the same command works from my terminal (but my terminal is root user so no permission issues I guess).

Note2: when I create the resource group then the ML workspace from Azure platform, I can run successfully the workflow file to create a compute cluster, upload dataset, and run an ML job (everything works except creating resource group or ML workspace).

I would appreciate your help in this matter!
please let me know if something else is needed to debug this issue.
Thanks

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Microsoft DevOps engineer helped me fix the issue, It was the scope of the service principal, it should be on the subscription level to be able to deploy resource group or ML workspace.

    Cheers


  2. 0

    I tried to create resource group and Machine Learning workspace with the github workflow by using Azure Service principal.

    As Azure RBAC ( role based access control) have these scopes in order –
    Management group > Subscription > Resource group> Resources.

    And as You need to create a new Resource group, The Service principal should have atleast contributor role assigned at the Subscription level. If you already have a resource group created, And want to create a new Machine learning workspace you can assign the service principal role scoped at the existing resource group.

    Refer the MS Document here to learn about above RBAC concepts and scopes.

    I tried creating a resource group and Machine learning workspace with github action using Azure CLI task and it failed with the same error, As my service principal used for in the github action secrets did not have role assigned at the subscription level, so while creating the new resource group, The task failed. Refer below:-

    enter image description here

    I created a new service principal and assigned it a contributor role at the subscription level, Like below:-

    Command:-

    I have referred the below command from this MS Document:-

    az ad sp create-for-rbac --name "<serviceprincipal-app>"
--role contributor --scopes /subscriptions/<subscription-id> --sdk-auth

    Output:-

    enter image description here

    Role assigned in Portal:-

    enter image description here

    Added this value in the github secrets like below referred from this Document:-

    enter image description here

    Ran the Workflow like below:-

    And the resource group with Machine Learning workspace got created successfully:-

    Code:-

    I have referred this MS Document to create the below ML Workspace with Github actions:-

    name: Create Azure ML Workspace

on:   workflow_dispatch:

env:   # Update the Azure region and resource group name as per your
requirements   REGION: "westus2"   RESOURCE_GROUP: "<resource-group>" 
WORKSPACE_NAME: "<ml-workspace>"

jobs:   create-workspace:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the code
        uses: actions/checkout@v2

      - name: Login to Azure
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Create the resource group
        uses: azure/CLI@v1
        with:
          inlineScript: |
            az group create 
              --name ${{ env.RESOURCE_GROUP }} 
              --location ${{ env.REGION }}
            echo "Resource group created successfully"

      - name: Create the Azure ML Workspace
        uses: azure/CLI@v1
        with:
          inlineScript: |
            az extension add --name azure-cli-ml
            az ml workspace create 
              --workspace-name ${{ env.WORKSPACE_NAME }} 
              --resource-group ${{ env.RESOURCE_GROUP }}  
              --location ${{ env.REGION }}
            echo "Azure ML workspace created successfully"

    Output:-

    enter image description here

    enter image description here

    Portal:-

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search