[AVM Module Issue]: event-grid/system-topic externalResourceRoleAssignments fails for cross-resource-group destinations (ResourceNotFound)

[Mirabis]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

Module Name

avm/res/event-grid/system-topic

(Optional) Module Version

0.6.5

Description

When externalResourceRoleAssignments targets a resource in a different resource group than the system topic, deployment fails with ResourceNotFound.

The generated inner role-assignment deployment (*-EventGrid-SysTopic-ExtRoleAssign-* → *-ResourceRoleAssignment) runs in the system topic's resource group and does not derive/set the target resource group from the supplied resourceId. ARM then resolves the extension-scope resource in the wrong RG.

Repro

// deployed into RG "rg-topic"; destination SA lives in "rg-dest"
module systemTopic 'br/public:avm/res/event-grid/system-topic:0.6.5' = {
  name: 'st'
  params: {
    name: 'st-demo'
    source: '<source SA resourceId in rg-topic>'
    topicType: 'Microsoft.Storage.StorageAccounts'
    managedIdentities: { systemAssigned: true }
    externalResourceRoleAssignments: [
      {
        resourceId: '/subscriptions/<sub>/resourceGroups/rg-dest/providers/Microsoft.Storage/storageAccounts/<destSa>'
        roleDefinitionId: 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a' // Storage Queue Data Message Sender
        roleName: 'Storage Queue Data Message Sender'
      }
    ]
  }
}

Observed (deployment operation on inner *-ResourceRoleAssignment)

code:    ResourceNotFound
target:  .../resourceGroups/rg-dest/providers/Microsoft.Storage/storageAccounts/<destSa>/providers/Microsoft.Authorization/roleAssignments/<guid>
message: "The Resource 'Microsoft.Storage/storageAccounts/<destSa>' under resource group 'rg-topic' was not found."

The role-assignment id correctly points at rg-dest, but ARM looks for the destination under rg-topic (the deployment's RG).

Note: az deployment group validate and what-if both report success — neither catches the cross-RG write rejection; it only surfaces at actual deploy.

Expected

externalResourceRoleAssignments should support destinations in any RG/subscription by deriving resourceGroup/subscriptionId from the provided resourceId and setting them on the nested role-assignment deployment (as avm/ptn/authorization/resource-role-assignment already supports when called directly with an explicit scope).

Workaround

Call avm/ptn/authorization/resource-role-assignment as a separate module with explicit scope: resourceGroup(<destRg>), and set externalResourceRoleAssignments: [].

(Optional) Correlation Id

69c25a0c-f98a-440a-b638-21d88c9df767

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

[avm-organizer]

@Mirabis, thanks for submitting this issue for the avm/res/event-grid/system-topic module!

Important

A member of the @Azure/avm-res-eventgrid-systemtopic-module-owners-bicep team will review it soon!