Role Assignment using ARM template on different Resource Group

I have the below ARM template that will run on ResourceGroupA and do a role assignment on a resource present in ResourceGroupB. The resources that I am using is Managed Identity in RG-A and KeyVault in RG-B. Whenever I run, I am having issues resolving the key vault resource that is used.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "managedIdentityName": {
      "type": "string",
      "defaultValue": "mymanagedidentityname"
    }
  },
  "variables": {
    "kvResourceGroupName": "ResourceGroupB",
    "kvName": "myKv",
    "userAssignedIdentityApiVersion": "2018-11-30",
    "kvSecretsUserRoleId": "b86a8fe4-44ce-4948-aee5-eccb2c155cd7"
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(concat(subscription().id, variables('kvName'), parameters('managedIdentityName'), variables('kvSecretsUserRoleId')))]",
      "scope": "[format('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.KeyVault/vaults/{2}', subscription().subscriptionId, variables('kvResourceGroupName'), variables('kvName'))]",
      "properties": {
        "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', variables('kvSecretsUserRoleId'))]",
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('managedIdentityName')), '2018-11-30').principalId]"
      }
    }
  ]
}

The error that I get says "The Resource 'myKv' under resource group 'ResourceGroupA' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix."

Appreciate any help. Thanks!

Role Assignment using ARM template on different Resource Group

I do agree with Thomos for suggesting same point.

If you are assigning the role in a different resource group and the identity is in another resource group, make sure to specify the identity's resource group details in the ARM template and deploy it in the Key Vault's resource group

Here is the updated ARM code for role assignment.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "managedIdentityName": {
      "type": "string",
      "defaultValue": "Venkat-UAM"
    },
    "managedIdentityResourceGroupName": {
      "type": "string",
      "defaultValue": "Venkat-RG"
    }
  },
  "variables": {
    "kvResourceGroupName": "Key_vault",
    "kvName": "Venkt-Vault",
    "userAssignedIdentityApiVersion": "2018-11-30",
    "kvSecretsUserRoleId": "4633458b-17de-408a-b874-0445c86b69e6"
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(concat(subscription().id, variables('kvName'), parameters('managedIdentityName'), variables('kvSecretsUserRoleId')))]",
      "scope": "[format('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.KeyVault/vaults/{2}', subscription().subscriptionId, variables('kvResourceGroupName'), variables('kvName'))]",
      "properties": {
        "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', variables('kvSecretsUserRoleId'))]",
        "principalId": "[reference(resourceId(parameters('managedIdentityResourceGroupName'), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), variables('userAssignedIdentityApiVersion')).principalId]"
      }
    }
  ]
}

In my case UAM(Identity)in [Venkat-RG] and Key vault in [Key_vault] resource group.

While deploying the script, make sure to deploy it in Resource Group B

 New-AzResourceGroupDeployment -ResourceGroupName "Key_vault" -TemplateFile "roleassignment.json"

Output:

After executing the script, the role has been successfully assigned to the Key Vault.