{"action":"opened","issue":{"url":"https://api.github.com/repos/Azure/azure-powershell/issues/6201","repository_url":"https://api.github.com/repos/Azure/azure-powershell","labels_url":"https://api.github.com/repos/Azure/azure-powershell/issues/6201/labels{/name}","comments_url":"https://api.github.com/repos/Azure/azure-powershell/issues/6201/comments","events_url":"https://api.github.com/repos/Azure/azure-powershell/issues/6201/events","html_url":"https://github.com/Azure/azure-powershell/issues/6201","id":322199038,"number":6201,"title":"Subnet Creation Issue through Powershell","user":{"login":"SomilGanguly","id":37686584,"avatar_url":"https://avatars1.githubusercontent.com/u/37686584?v=4","gravatar_id":"","url":"https://api.github.com/users/SomilGanguly","html_url":"https://github.com/SomilGanguly","followers_url":"https://api.github.com/users/SomilGanguly/followers","following_url":"https://api.github.com/users/SomilGanguly/following{/other_user}","gists_url":"https://api.github.com/users/SomilGanguly/gists{/gist_id}","starred_url":"https://api.github.com/users/SomilGanguly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SomilGanguly/subscriptions","organizations_url":"https://api.github.com/users/SomilGanguly/orgs","repos_url":"https://api.github.com/users/SomilGanguly/repos","events_url":"https://api.github.com/users/SomilGanguly/events{/privacy}","received_events_url":"https://api.github.com/users/SomilGanguly/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-11T07:38:30Z","updated_at":"2018-05-11T07:38:30Z","closed_at":null,"author_association":"NONE","body":"We are facing issues while creating a subnet. PFB the case analysis:\r\n\r\nPolicy Description: \r\n\r\n1. Enforce NSG - Makes sure that a particular NSG is added while creating subnet, without which it doesn't allow to create subnet\r\n2. Enforce UDR - Makes sure that a particular UDR is added while creating subnet, without which it doesn't allow to create subnet\r\n\r\n1.\tScenario 1: User has been added to the role - OWNER \r\nA.\tCase A: Trying to create subnet through portal using correct UDR and NSG (with policies - enforce udr and NSG in place) -> It works well\r\nB.\tCase B: Trying to create subnet through ARM Template using correct UDR and NSG (with policies - enforce udr and NSG in place) -> It works well (ARM Template has been attached)\r\nC.\tCase C: Trying to create subnet through PowerShell using correct UDR and NSG (with policies - enforce udr and NSG in place) -> It fails by policy (PowerShell command has been attached)\r\n\r\n2.\tScenario 2: User has been added to the role - SERVICE OWNER ADMINISTRATOR (Custom Role where VirtualNetwork/write is denied) \r\nA.\tCase A: Trying to create subnet through portal using correct UDR and NSG (with policies - enforce udr and NSG in place) -> It works well\r\nB.\tCase B: Trying to create subnet through ARM Template using correct UDR and NSG (with policies - enforce udr and NSG in place) -> It works well\r\nC.\tCase C: Trying to create subnet through PowerShell using correct UDR and NSG (with policies - enforce udr and NSG in place) -> It fails by RBAC, complains about user object not having authorization to perform write operation over Vnet (object id ‘' does not have authorization to perform action 'Microsoft.Network/virtualNetworks/write' over scope '/subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/virtualNetworks/xxxx). It doesn’t even reach till policy exception.\r\n"}}
{"actor":{"display_login":"SomilGanguly"}}