fix(iac/azure): remove nonexistent Microsoft.Capacity action from reservation-purchaser role

.github/workflows/deploy-azure.yml

@@ -237,9 +237,12 @@ jobs:
 
       # The provider fails the data read outright when the custom role is absent,
       # so a Terraform precondition can never run for this case. Issue #1794: the
-      # Azure deploy failed on every main run for three weeks because the raw
-      # provider error names neither the missing prerequisite nor the stack that
-      # creates it, and the explanation lived only in a source comment.
+      # Azure deploy failed on every main run since 2026-07-19 because the
+      # bootstrap stack's role definition carried an action that does not exist
+      # in Azure's operation catalog, so Azure rejected the whole role definition
+      # with InvalidActionOrNotAction and the role was never created. That action
+      # is removed in this PR. The message below still covers the general "role
+      # missing" case for any future recurrence.
       - name: Explain a missing bootstrap role
         if: failure()
         run: |
@@ -276,11 +279,16 @@ jobs:
           pipeline holds roleAssignments/write only.
 
           If the bootstrap HAS been applied, check in this order:
-            1. the deploy SP has Microsoft.Authorization/roleDefinitions/read.
+            1. the bootstrap stack's own apply log for InvalidActionOrNotAction.
+               That means the role definition itself was rejected by Azure and
+               never created, not merely unassigned (issue #1794's root cause:
+               a nonexistent action in the role's actions list). Make sure the
+               bootstrap module is on a commit that includes that fix.
+            2. the deploy SP has Microsoft.Authorization/roleDefinitions/read.
                Without it the lookup returns empty, which is indistinguishable
                from the role being absent.
-            2. the role was not renamed or deleted out of band.
-            3. the name suffix still matches. The runtime module looks up
+            3. the role was not renamed or deleted out of band.
+            4. the name suffix still matches. The runtime module looks up
                "CUDly Reservation Purchaser (custom) - <subscription-id>";
                the bootstrap builds the name from its own var.name_suffix.
           EOT

arm/CUDly-CrossSubscription/template.json

@@ -39,7 +39,7 @@
       "name": "[variables('customRoleName')]",
       "properties": {
         "roleName": "CUDly Reservation Purchaser (custom)",
-        "description": "Custom role granting CUDly exactly the Microsoft.Capacity and Microsoft.BillingBenefits actions required by the calculatePrice -> purchase flow. Replaces the built-in Reservation Purchaser, which lacks reservationOrders/purchase/action.",
+        "description": "Custom role granting CUDly exactly the Microsoft.Capacity and Microsoft.BillingBenefits actions required by the calculatePrice -> purchase flow. Replaces the built-in Reservation Purchaser, which lacks reservationOrders/write, calculatePrice/action and every Microsoft.BillingBenefits action.",
         "type": "CustomRole",
         "permissions": [
           {
@@ -49,7 +49,6 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/register/action",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
@@ -79,7 +78,7 @@
         "roleDefinitionId": "[variables('customRoleDefinitionId')]",
         "principalId": "[parameters('servicePrincipalObjectId')]",
         "principalType": "ServicePrincipal",
-        "description": "CUDly — subscription-scope assignment of custom role; grants calculatePrice + purchase/action required by the two-step reservation purchase flow"
+        "description": "CUDly — subscription-scope assignment of custom role; grants calculatePrice/action and reservationOrders/write required by the two-step reservation purchase flow"
       }
     },
 

iac/federation/azure-target/terraform/main.tf

@@ -60,8 +60,9 @@ resource "azuread_application_federated_identity_credential" "cudly" {
 
 # Custom role: grants the exact Microsoft.Capacity and Microsoft.BillingBenefits actions
 # used by the calculatePrice -> purchase flow (introduced in PR #680). The built-in
-# Reservation Purchaser role lacks reservationOrders/purchase/action, which causes 403 on
-# production reservation purchases.
+# Reservation Purchaser role lacks reservationOrders/write and calculatePrice/action, plus
+# every Microsoft.BillingBenefits action, which is what caused 403s on production
+# reservation purchases.
 #
 # The role definition is factored into a shared module so the customer-side (here) and
 # host-side (terraform/modules/compute/azure/container-apps) definitions stay in lockstep.

scripts/testdata/role-parity/canonical-scope-variants-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/collision-assignablescopes-benign-first-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/collision-assignablescopes-evil-first-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/collision-properties-evil-first-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/collision-roledefinitionid-evil-first-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/collision-root-resources-evil-first-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",
@@ -58,7 +58,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/collision-type-evil-first-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/dataactions-wildcard-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/decorative-variables-arm.json

@@ -33,7 +33,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/deploymentscript-scope-escape-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/deploymentstack-scope-escape-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/foreign-subscription-literal-with-canonical-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/legacy-child-keyvault-roleassignment-owner-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/legacy-child-roleassignment-owner-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/lowercase-tenant-scope-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/lowercase-type-wildcard-actions-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/matching-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/matching-tf.tf.fixture

@@ -11,7 +11,7 @@ resource "azurerm_role_definition" "cudly_reservation_purchaser" {
       "Microsoft.Capacity/catalogs/read",
       "Microsoft.Capacity/reservationOrders/read",
       "Microsoft.Capacity/reservationOrders/write",
-      "Microsoft.Capacity/reservationOrders/purchase/action",
+      "Microsoft.BillingBenefits/register/action",
       "Microsoft.Capacity/reservationOrders/reservations/read",
       "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
       "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/mgmt-group-schema-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/miscased-assignablescopes-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",
@@ -46,7 +46,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/miscased-properties-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/miscased-roledefinitionid-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/miscased-scope-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/nested-deployment-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/obfuscated-tenant-scope-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/other-subscription-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",

scripts/testdata/role-parity/pim-roleassignment-schedule-owner-arm.json

@@ -16,7 +16,7 @@
               "Microsoft.Capacity/catalogs/read",
               "Microsoft.Capacity/reservationOrders/read",
               "Microsoft.Capacity/reservationOrders/write",
-              "Microsoft.Capacity/reservationOrders/purchase/action",
+              "Microsoft.BillingBenefits/register/action",
               "Microsoft.Capacity/reservationOrders/reservations/read",
               "Microsoft.BillingBenefits/savingsPlanOrderAliases/write",
               "Microsoft.BillingBenefits/savingsPlanOrders/read",