I have a few template spec bicep modules created in a subscription (subscription A).
From another subscription (subscription B), I have a main bicep file which it references this template spec module from subscription A.
My user has "template spec reader" permission on this template spec resource (subscription A).
My user has "service administrator" permission on subscription B.
When running the deployment, I am getting a strange error:
InvalidTemplateDeployment - Deployment failed with multiple errors: 'Authorization failed for template resource 'rg-test' of type 'Microsoft.Resources/resourceGroups'. The client 'email@example.com' with object id '74a10223-2dfb-4695-86ab-b26d9c284364' does not have permission to perform action 'Microsoft.Resources/subscriptions/resourceGroups/write' at scope '/subscriptions//resourceGroups/rg-test'.
It is apparently this is quite a strange error, since I have full access to subscription B.
I also did another test by create the same template spec resource in subscription B, then this is working fine, no issue.
Please help me to identity what am I missing here, looks like there is additional permissions I need to grant?