azure_rm_roledefinition fails when description is set (except for initial creation)

[wrprice]

SUMMARY

Setting the description property on the azure_rm_roledefinition module succeeds during initial creation, but fails on subsequent runs with a Python stacktrace during check_update without making any other changes.

ISSUE TYPE

• Bug Report

COMPONENT NAME

azure_rm_roledefinition

ANSIBLE VERSION

ansible 2.9.9
  config file = /home/myUserDir/ansible/ansible.cfg
  configured module search path = ['/home/myUserDir/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.6.9 (default, Apr 18 2020, 01:56:04) [GCC 8.4.0]

CONFIGURATION

DEFAULT_HOST_LIST(/home/myUserDir/ansible/ansible.cfg) = ['/home/myUserDir/ansible/inventory']
DEFAULT_PRIVATE_KEY_FILE(/home/myUserDir/ansible/ansible.cfg) = /home/myUserDir/auth/ssh/local/id_rsa
INVENTORY_ENABLED(/home/myUserDir/ansible/ansible.cfg) = ['auto', 'yaml']

OS / ENVIRONMENT

Windows 10 Enterprise version 1909 build 18363.900
WSL 1.x running Ubuntu 18.04.4 LTS
Linux 4.4.0-18362-Microsoft #836-Microsoft Mon May 05 16:04:00 PST 2020 x86_64 x86_64 x86_64 GNU/Linux

STEPS TO REPRODUCE

1. Update provided example play with a valid subscription ID, change auth_source as needed.
2. Run example play, it should create a new custom role (1 changed)
3. Run example play again, it will fail with a python stacktrace

- hosts: localhost
  gather_facts: no
  vars:
    subscription_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

  tasks:
    - azure_rm_roledefinition:
        auth_source: cli
        subscription_id: "{{ subscription_id | mandatory }}"
        name: Test Custom RBAC Role
        description: Can be set on create, but throws on subsequent runs
        scope: "/subscriptions/{{ subscription_id | mandatory }}"
        assignable_scopes:
          - "/subscriptions/{{ subscription_id | mandatory }}"
        state: present
        permissions:
          - actions:
              - "*/read"

EXPECTED RESULTS

On first run, expect play successful with ok=1 changed=1 failed=0
On second run, expect play successful with ok=1 changed=0 failed=0

ACTUAL RESULTS

Second run terminates with Python exception, ok=0 changed=0 failed=1

First run:

PLAY [localhost] ***************************************************************************************************************************

TASK [azure_rm_roledefinition] *************************************************************************************************************
[WARNING]: Azure API profile latest does not define an entry for AuthorizationManagementClient
changed: [localhost]

PLAY RECAP *********************************************************************************************************************************
localhost                  : ok=1    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Second run:

PLAY [localhost] ***************************************************************************************************************************

TASK [azure_rm_roledefinition] *************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: KeyError: 'properties'
fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n  File \"/home/myUserDir/.ansible/tmp/ansible-tmp-1591976595.156447-7552-47076256971497/AnsiballZ_azure_rm_roledefinition.py\", line 102, in <module>\n    _ansiballz_main()\n  File \"/home/myUserDir/.ansible/tmp/ansible-tmp-1591976595.156447-7552-47076256971497/AnsiballZ_azure_rm_roledefinition.py\", line 94, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/home/myUserDir/.ansible/tmp/ansible-tmp-1591976595.156447-7552-47076256971497/AnsiballZ_azure_rm_roledefinition.py\", line 40, in invoke_module\n    runpy.run_module(mod_name='ansible.modules.cloud.azure.azure_rm_roledefinition', init_globals=None, run_name='__main__', alter_sys=True)\n  File \"/usr/lib/python3.6/runpy.py\", line 205, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib/python3.6/runpy.py\", line 96, in _run_module_code\n    mod_name, mod_spec, pkg_name, script_name)\n  File \"/usr/lib/python3.6/runpy.py\", line 85, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_azure_rm_roledefinition_payload_q4mkw6wi/ansible_azure_rm_roledefinition_payload.zip/ansible/modules/cloud/azure/azure_rm_roledefinition.py\", line 402, in <module>\n  File \"/tmp/ansible_azure_rm_roledefinition_payload_q4mkw6wi/ansible_azure_rm_roledefinition_payload.zip/ansible/modules/cloud/azure/azure_rm_roledefinition.py\", line 398, in main\n  File \"/tmp/ansible_azure_rm_roledefinition_payload_q4mkw6wi/ansible_azure_rm_roledefinition_payload.zip/ansible/modules/cloud/azure/azure_rm_roledefinition.py\", line 209, in __init__\n  File \"/tmp/ansible_azure_rm_roledefinition_payload_q4mkw6wi/ansible_azure_rm_roledefinition_payload.zip/ansible/module_utils/azure_rm_common.py\", line 348, in __init__\n  File \"/tmp/ansible_azure_rm_roledefinition_payload_q4mkw6wi/ansible_azure_rm_roledefinition_payload.zip/ansible/modules/cloud/azure/azure_rm_roledefinition.py\", line 248, in exec_module\n  File \"/tmp/ansible_azure_rm_roledefinition_payload_q4mkw6wi/ansible_azure_rm_roledefinition_payload.zip/ansible/modules/cloud/azure/azure_rm_roledefinition.py\", line 287, in check_update\nKeyError: 'properties'\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

PLAY RECAP *********************************************************************************************************************************
localhost                  : ok=0    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

Seems to be a problem referencing old_definition['properties'] on line 287. As a workaround, leaving the description property unset in the play bypasses this check.