Repository: ansible/ansible

Issue:
Azure authorization problem on NIC provisioning
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and devel branch are affected too.
-->

##### ISSUE TYPE
Bug report

##### COMPONENT NAME
azure_rm_networkinterface
<!---
Name of the module, plugin, task or feature
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path
-->

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes below -->
```
ansible 2.5.0b2
  config file = /home/ubuntu/azure/ansible/ansible.cfg
  configured module search path = [u'/home/ubuntu/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.12 (default, Dec  4 2017, 14:50:18) [GCC 5.4.0 20160609]
```

##### CONFIGURATION
<!---
If using Ansible 2.4 or above, paste the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.
-->
```
ANSIBLE_FORCE_COLOR(env: ANSIBLE_FORCE_COLOR) = True
ANSIBLE_SSH_ARGS(/home/ubuntu/azure/ansible/ansible.cfg) = -o "StrictHostKeyChecking no" -o "UserKnownHostsFile /dev/null"
DEFAULT_CALLBACK_WHITELIST(/home/ubuntu/azure/ansible/ansible.cfg) = ['profile_tasks']
```

##### SUMMARY
<!--- Explain the problem briefly -->
When provisioning a NIC and attaching it to a virtual network, the VM contributor role should be sufficient to perform that operation. However, due to the actual implementation of the Ansible module also read permission on the whole virtual network is required. Otherwise the module fails when trying to reading out the subnet information.

##### STEPS TO REPRODUCE
<!---
For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used.
-->
* Create a virtual network with a subnet in a resource group.
* Assign VM Contributor role to the provisioning user for that resource group
* Execute the following playbook

<!--- Paste example playbooks or commands between quotes below -->
```yaml
  - name: Create NIC
    azure_rm_networkinterface:
      resource_group: "{{ resgrp }}"
      name: 'vm-{{ basename }}01'     
      virtual_network_name: "{{ default_vnet_fq }}"
      subnet_name: "{{ default_subnet }}"  
      ip_configurations:
        - name: ipconfig1
          primary: True
          public_ip_address_name: dontcare
```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
The NIC should be created and attached to the virtual network.
<!--- What did you expect to happen when running the steps above? -->

##### ACTUAL RESULTS
Module execution fails with an indication that the user is not authorized to read out the subnet configuration (due to missing permissions)
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```

```



Discussion:
Files identified in the description:
* [lib/ansible/modules/cloud/azure/azure_rm_networkinterface.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/cloud/azure/azure_rm_networkinterface.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @haroldwongms @nitzmahone @trstringer @xscript @yuwzho @zikalino
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
@zikalino will work on it.

Resolving patch:
diff --git a/lib/ansible/modules/cloud/azure/azure_rm_networkinterface.py b/lib/ansible/modules/cloud/azure/azure_rm_networkinterface.py
--- a/lib/ansible/modules/cloud/azure/azure_rm_networkinterface.py
+++ b/lib/ansible/modules/cloud/azure/azure_rm_networkinterface.py
@@ -502,9 +502,13 @@ def exec_module(self, **kwargs):
 
         if changed:
             if self.state == 'present':
-                subnet = self.get_subnet(virtual_network_resource_group, virtual_network_name, self.subnet_name)
-                if not subnet:
-                    self.fail('subnet {0} is not exist'.format(self.subnet_name))
+                subnet = self.network_models.SubResource(
+                    '/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Network/virtualNetworks/{2}/subnets/{3}'.format(
+                        self.subscription_id,
+                        virtual_network_resource_group,
+                        virtual_network_name,
+                        self.subnet_name))
+
                 nic_ip_configurations = [
                     self.network_models.NetworkInterfaceIPConfiguration(
                         private_ip_allocation_method=ip_config.get('private_ip_allocation_method'),
@@ -572,13 +576,6 @@ def get_public_ip_address(self, name):
         except Exception as exc:
             return None
 
-    def get_subnet(self, resource_group, vnet_name, subnet_name):
-        self.log("Fetching subnet {0} in virtual network {1}".format(subnet_name, vnet_name))
-        try:
-            return self.network_client.subnets.get(resource_group, vnet_name, subnet_name)
-        except Exception as exc:
-            return None
-
     def get_security_group(self, name):
         self.log("Fetching security group {0}".format(name))
         try:


Test patch: