Skip to content

Commit 74c52d1

Browse files
dominicbettsdominicbetts
authored
Add custom RBAC role definitions (#122)
## Purpose Add JSON sample files that define custom RBAC roles for Azure IoT Operations ## Does this introduce a breaking change? <!-- Mark one with an "x". --> ``` [ ] Yes [x] No ``` ## Pull Request Type What kind of change does this Pull Request introduce? <!-- Please check the one that applies to this PR using "x". --> ``` [ ] Bugfix [ ] Feature [ ] Code style update (formatting, local variables) [ ] Refactoring (no functional changes, no api changes) [x] Documentation content changes [ ] Other... Please describe: ``` ## Other Information These sample definitions will be referenced from an article on Learn
1 parent a5c3dcd commit 74c52d1

15 files changed

+654
-0
lines changed

‎samples/custom-rbac/AIO Administrator.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Administrator",
4+
"description": "View, create, edit and delete AIO resources. Manage all resources, including instance and its downstream resources, asset, discovered assets, asset endpoint profiles.",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.Authorization/roleAssignments/write",
12+
"Microsoft.DeviceRegistry/assetEndpointProfiles/delete",
13+
"Microsoft.DeviceRegistry/assetEndpointProfiles/read",
14+
"Microsoft.DeviceRegistry/assetEndpointProfiles/write",
15+
"Microsoft.DeviceRegistry/assets/delete",
16+
"Microsoft.DeviceRegistry/assets/read",
17+
"Microsoft.DeviceRegistry/assets/write",
18+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/delete",
19+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/read",
20+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/write",
21+
"Microsoft.DeviceRegistry/discoveredAssets/delete",
22+
"Microsoft.DeviceRegistry/discoveredAssets/read",
23+
"Microsoft.DeviceRegistry/discoveredAssets/write",
24+
"Microsoft.DeviceRegistry/register/action",
25+
"Microsoft.DeviceRegistry/schemaRegistries/read",
26+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/read",
27+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/schemaVersions/read",
28+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/schemaVersions/write",
29+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/write",
30+
"Microsoft.DeviceRegistry/schemaRegistries/write",
31+
"Microsoft.Edge/sites/read",
32+
"Microsoft.Edgeorder/addresses/read",
33+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
34+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
35+
"Microsoft.ExtendedLocation/customLocations/read",
36+
"Microsoft.ExtendedLocation/customLocations/write",
37+
"Microsoft.ExtendedLocation/register/action",
38+
"Microsoft.IoTOperations/*",
39+
"Microsoft.KeyVault/vaults/read",
40+
"Microsoft.KeyVault/vaults/write",
41+
"Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
42+
"Microsoft.Kubernetes/connectedclusters/read",
43+
"Microsoft.Kubernetes/register/action",
44+
"Microsoft.KubernetesConfiguration/extensions/operations/read",
45+
"Microsoft.KubernetesConfiguration/extensions/read",
46+
"Microsoft.KubernetesConfiguration/extensions/write",
47+
"Microsoft.KubernetesConfiguration/extensionTypes/read",
48+
"Microsoft.KubernetesConfiguration/register/action",
49+
"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
50+
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
51+
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
52+
"Microsoft.ManagedIdentity/userAssignedIdentities/read",
53+
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
54+
"Microsoft.Resources/deployments/operationStatuses/read",
55+
"Microsoft.Resources/deployments/read",
56+
"Microsoft.Resources/deployments/validate/action",
57+
"Microsoft.Resources/deployments/whatIf/action",
58+
"Microsoft.Resources/deployments/write",
59+
"Microsoft.Resources/subscriptions/read",
60+
"Microsoft.Resources/subscriptions/resourceGroups/read",
61+
"Microsoft.Resources/subscriptions/resourceGroups/resources/read",
62+
"Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
63+
"Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
64+
"Microsoft.SecretSyncController/register/action",
65+
"Microsoft.SecretSyncController/secretSyncs/read",
66+
"Microsoft.SecretSyncController/secretSyncs/write",
67+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
68+
"Microsoft.Storage/storageAccounts/listKeys/action",
69+
"Microsoft.Storage/storageAccounts/read",
70+
"Microsoft.Storage/storageAccounts/write"
71+
],
72+
"notActions": [],
73+
"dataActions": [
74+
"Microsoft.KeyVault/vaults/secrets/getSecret/action",
75+
"Microsoft.KeyVault/vaults/secrets/readMetadata/action",
76+
"Microsoft.KeyVault/vaults/secrets/setSecret/action"
77+
],
78+
"notDataActions": []
79+
}
80+
]
81+
}
82+
}

‎samples/custom-rbac/AIO Asset Administrator.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Asset Administrator",
4+
"description": "View, create, edit and delete AIO Assets",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.DeviceRegistry/assetEndpointProfiles/read",
12+
"Microsoft.DeviceRegistry/assets/delete",
13+
"Microsoft.DeviceRegistry/assets/read",
14+
"Microsoft.DeviceRegistry/assets/write",
15+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/read",
16+
"Microsoft.DeviceRegistry/discoveredAssets/delete",
17+
"Microsoft.DeviceRegistry/discoveredAssets/read",
18+
"Microsoft.DeviceRegistry/discoveredAssets/write",
19+
"Microsoft.Edge/sites/read",
20+
"Microsoft.Edgeorder/addresses/read",
21+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
22+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
23+
"Microsoft.ExtendedLocation/customLocations/read",
24+
"Microsoft.Iotoperations/instances/read",
25+
"Microsoft.Kubernetes/connectedclusters/read",
26+
"Microsoft.KubernetesConfiguration/extensions/read",
27+
"Microsoft.Resources/subscriptions/read",
28+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read"
29+
],
30+
"notActions": [],
31+
"dataActions": [],
32+
"notDataActions": []
33+
}
34+
]
35+
}
36+
}

‎samples/custom-rbac/AIO Asset Endpoint Administrator.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Asset Endpoint Administrator",
4+
"description": "View, create, edit and delete AIO Asset Endpoints",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.DeviceRegistry/assetEndpointProfiles/delete",
12+
"Microsoft.DeviceRegistry/assetEndpointProfiles/read",
13+
"Microsoft.DeviceRegistry/assetEndpointProfiles/write",
14+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/delete",
15+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/read",
16+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/write",
17+
"Microsoft.Edge/sites/read",
18+
"Microsoft.Edgeorder/addresses/read",
19+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
20+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
21+
"Microsoft.ExtendedLocation/customLocations/read",
22+
"Microsoft.Iotoperations/instances/read",
23+
"Microsoft.Kubernetes/connectedclusters/read",
24+
"Microsoft.KubernetesConfiguration/extensions/read",
25+
"Microsoft.Resources/subscriptions/read",
26+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read",
27+
"Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
28+
"Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
29+
"Microsoft.SecretSyncController/secretSyncs/read",
30+
"Microsoft.SecretSyncController/secretSyncs/write"
31+
],
32+
"notActions": [],
33+
"dataActions": [
34+
"Microsoft.KeyVault/vaults/secrets/getSecret/action",
35+
"Microsoft.KeyVault/vaults/secrets/readMetadata/action",
36+
"Microsoft.KeyVault/vaults/secrets/setSecret/action"
37+
],
38+
"notDataActions": []
39+
}
40+
]
41+
}
42+
}

‎samples/custom-rbac/AIO Asset Endpoint Viewer.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Asset Endpoint Viewer",
4+
"description": "View AIO Asset Endpoint list and details",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.DeviceRegistry/assetEndpointProfiles/read",
12+
"Microsoft.DeviceRegistry/discoveredAssetEndpointProfiles/read",
13+
"Microsoft.Edge/sites/read",
14+
"Microsoft.Edgeorder/addresses/read",
15+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
16+
"Microsoft.ExtendedLocation/customLocations/read",
17+
"Microsoft.Iotoperations/instances/read",
18+
"Microsoft.Kubernetes/connectedclusters/read",
19+
"Microsoft.KubernetesConfiguration/extensions/read",
20+
"Microsoft.Resources/subscriptions/read",
21+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read"
22+
],
23+
"notActions": [],
24+
"dataActions": [],
25+
"notDataActions": []
26+
}
27+
]
28+
}
29+
}

‎samples/custom-rbac/AIO Asset Viewer.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Asset Viewer",
4+
"description": "View assets list and details",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.DeviceRegistry/assets/read",
12+
"Microsoft.DeviceRegistry/discoveredAssets/read",
13+
"Microsoft.Edge/sites/read",
14+
"Microsoft.Edgeorder/addresses/read",
15+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
16+
"Microsoft.ExtendedLocation/customLocations/read",
17+
"Microsoft.Iotoperations/instances/read",
18+
"Microsoft.Kubernetes/connectedclusters/read",
19+
"Microsoft.KubernetesConfiguration/extensions/read",
20+
"Microsoft.Resources/subscriptions/read",
21+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read"
22+
],
23+
"notActions": [],
24+
"dataActions": [],
25+
"notDataActions": []
26+
}
27+
]
28+
}
29+
}

‎samples/custom-rbac/AIO Data Flow Administrator.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Data Flow Administrator",
4+
"description": "View, create, edit and delete AIO Dataflows",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.DeviceRegistry/assets/read",
12+
"Microsoft.DeviceRegistry/discoveredAssets/read",
13+
"Microsoft.DeviceRegistry/schemaRegistries/read",
14+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/read",
15+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/schemaVersions/read",
16+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/schemaVersions/write",
17+
"Microsoft.DeviceRegistry/schemaRegistries/schemas/write",
18+
"Microsoft.DeviceRegistry/schemaRegistries/write",
19+
"Microsoft.Edge/sites/read",
20+
"Microsoft.Edgeorder/addresses/read",
21+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
22+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
23+
"Microsoft.ExtendedLocation/customLocations/read",
24+
"Microsoft.IoTOperations/instances/dataflowEndpoints/read",
25+
"Microsoft.IoTOperations/instances/dataflowProfiles/dataflows/delete",
26+
"Microsoft.IoTOperations/instances/dataflowProfiles/dataflows/read",
27+
"Microsoft.IoTOperations/instances/dataflowProfiles/dataflows/write",
28+
"Microsoft.IoTOperations/instances/dataflowProfiles/read",
29+
"Microsoft.Iotoperations/instances/read",
30+
"Microsoft.Kubernetes/connectedclusters/read",
31+
"Microsoft.KubernetesConfiguration/extensions/read",
32+
"Microsoft.Resources/subscriptions/read",
33+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read"
34+
],
35+
"notActions": [],
36+
"dataActions": [],
37+
"notDataActions": []
38+
}
39+
]
40+
}
41+
}

‎samples/custom-rbac/AIO Data Flow Destination Administrator.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Data Flow Destination Administrator",
4+
"description": "View, create, edit and delete AIO Dataflow Destinations",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.Edge/sites/read",
12+
"Microsoft.Edgeorder/addresses/read",
13+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
14+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
15+
"Microsoft.ExtendedLocation/customLocations/read",
16+
"Microsoft.IoTOperations/instances/dataflowEndpoints/delete",
17+
"Microsoft.IoTOperations/instances/dataflowEndpoints/read",
18+
"Microsoft.IoTOperations/instances/dataflowEndpoints/write",
19+
"Microsoft.Iotoperations/instances/read",
20+
"Microsoft.Kubernetes/connectedclusters/read",
21+
"Microsoft.KubernetesConfiguration/extensions/read",
22+
"Microsoft.Resources/subscriptions/read",
23+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read",
24+
"Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
25+
"Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
26+
"Microsoft.SecretSyncController/secretSyncs/read",
27+
"Microsoft.SecretSyncController/secretSyncs/write"
28+
],
29+
"notActions": [],
30+
"dataActions": [
31+
"Microsoft.KeyVault/vaults/secrets/getSecret/action",
32+
"Microsoft.KeyVault/vaults/secrets/readMetadata/action",
33+
"Microsoft.KeyVault/vaults/secrets/setSecret/action"
34+
],
35+
"notDataActions": []
36+
}
37+
]
38+
}
39+
}

‎samples/custom-rbac/AIO Data Flow Destination Viewer.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Data Flow Destination Viewer ",
4+
"description": "View AIO Data flow Destination list and details",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.Edge/sites/read",
12+
"Microsoft.Edgeorder/addresses/read",
13+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
14+
"Microsoft.ExtendedLocation/customLocations/read",
15+
"Microsoft.IoTOperations/instances/dataflowEndpoints/read",
16+
"Microsoft.Iotoperations/instances/read",
17+
"Microsoft.Kubernetes/connectedclusters/read",
18+
"Microsoft.KubernetesConfiguration/extensions/read",
19+
"Microsoft.Resources/subscriptions/read",
20+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read"
21+
],
22+
"notActions": [],
23+
"dataActions": [],
24+
"notDataActions": []
25+
}
26+
]
27+
}
28+
}

‎samples/custom-rbac/AIO Data Flow Viewer.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"properties": {
3+
"roleName": "AIO Data Flow Viewer",
4+
"description": "View AIO Data flow list and details",
5+
"assignableScopes": [
6+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
7+
],
8+
"permissions": [
9+
{
10+
"actions": [
11+
"Microsoft.Edge/sites/read",
12+
"Microsoft.Edgeorder/addresses/read",
13+
"Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read",
14+
"Microsoft.ExtendedLocation/customLocations/read",
15+
"Microsoft.IoTOperations/instances/dataflowProfiles/dataflows/read",
16+
"Microsoft.IoTOperations/instances/dataflowProfiles/read",
17+
"Microsoft.Iotoperations/instances/read",
18+
"Microsoft.Kubernetes/connectedclusters/read",
19+
"Microsoft.KubernetesConfiguration/extensions/read",
20+
"Microsoft.Resources/subscriptions/read",
21+
"Microsoft.Resources/subscriptions/resourcegroups/resources/read"
22+
],
23+
"notActions": [],
24+
"dataActions": [],
25+
"notDataActions": []
26+
}
27+
]
28+
}
29+
}

0 commit comments

Comments
 (0)