In Bicep, I can use subscriptionResourceId() or managementGroupResourceId() to refer to a resource at the subscription or management group level, respectively.

In the following code, I’m using subscriptionResourceId() to create a (RBAC) role assignment at the subscription level for a system-assigned managed identity in a resource group:

resource keyVaultRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(
    subscription().id,
    subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')
  )
  scope: keyVault
  properties: {
    principalId: appServiceApp.identity.principalId
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions',
      '4633458b-17de-408a-b874-0445c86b69e6'
    )
  }
}

How would I get the resource’s resource group ID? The resourceId() function depends on the scope of the deployment, and so is ambiguous