You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/operator-nexus/concepts-cross-subscription-deployments-required-rbac-for-network-fabric.md
+23-19Lines changed: 23 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,20 +13,6 @@ ms.custom: template-concept
13
13
14
14
This document outlines the requirements and behaviors associated with managing Nexus Network Fabric (NNF) resources in Azure when dealing with multiple subscriptions. It describes various scenarios involving different levels of access permissions that can affect operations across subscriptions. This document also covers the linked access check implementation, which ensures that proper permissions and access controls are enforced when managing Network Fabric (NNF) resources across multiple subscriptions, verifying that the required cross-subscription links have the necessary authorizations in place.
15
15
16
-
## Permissions overview
17
-
18
-
To effectively manage NNF resources across Azure subscriptions, users must have the appropriate permissions. The following permissions are essential:
19
-
20
-
### Subscription-level permissions
21
-
22
-
-**Read access:** Users must have read access to view NNF resources within the subscription.
23
-
-**Contributor access:** Users can create and manage resources, including configuring settings and deleting resources.
24
-
-**Owner access:** Users have full control over the subscription, including the ability to manage permissions for other users.
25
-
26
-
### Resource-level permissions
27
-
28
-
-**Join access:** Users must have Join access to the specific NNF resources they wish to reference. For example, when a user tries to create an L2 or L3 isolation domain in **Subscription B** while referencing an NNF resource in **Subscription A**, the user must have Join access on the NNF resource.
29
-
30
16
## Subscription context and user permissions
31
17
32
18
In this document, we consider two Azure subscriptions, **Subscription A** and **Subscription B**, where users interact with NNF resources. The permissions assigned to users in each subscription determine their ability to manage these resources effectively.
@@ -58,22 +44,40 @@ In this scenario, the user has no access to **Subscription A**, where the Networ
58
44
>[!NOTE]
59
45
>Network Fabric cannot be created in a different subscription than the referenced Network Fabric Controller (NFC).
60
46
61
-
## Resource management considerations
47
+
## Key considerations
48
+
49
+
To effectively manage NNF resources across Azure subscriptions, users must have the appropriate permissions. The following permissions are essential:
50
+
51
+
### Permission management
52
+
53
+
#### Subscription-level permissions
54
+
55
+
-**Read access:** Users must have read access to view NNF resources within the subscription.
56
+
57
+
-**Contributor access:** Users can create and manage resources, including configuring settings and deleting resources.
58
+
59
+
-**Owner access:** Users have full control over the subscription, including the ability to manage permissions for other users.
60
+
61
+
#### Resource-level permissions
62
+
63
+
-**Join access:** Users must have Join access to the specific NNF resources they wish to reference. For example, when a user tries to create an L2 or L3 isolation domain in **Subscription B** while referencing an NNF resource in **Subscription A**, the user must have Join access on the NNF resource.
64
+
65
+
### Resource management
62
66
63
-
### Resource creation
67
+
####Resource creation
64
68
65
69
- Ensure that users have the necessary subscription-level permissions before attempting to create NNF resources.
66
70
67
71
- When referencing resources from another subscription, confirm that the user has both read access to that subscription and Join access to the specific NNF resource.
68
72
69
-
### Resource configuration
73
+
####Resource configuration
70
74
71
75
- Users with 'Contributor` or `Owner` access can configure NNF resources. However, they must have the appropriate permissions for each specific configuration action.
72
76
73
-
### Resource deletion
77
+
####Resource deletion
74
78
75
79
- Deleting NNF resources typically requires `Contributor`, `Owner` or `Delete` access on the resource. Users should be aware of any dependencies that may prevent deletion.
76
80
77
81
### Cross-Subscription management
78
82
79
-
- When managing NNF resources across multiple subscriptions, it’s crucial to maintain a clear understanding of the permissions structure to avoid `AuthorizationFailed` and `LinkedAuthorizationFailed` errors.
83
+
- When managing NNF resources across multiple subscriptions, it’s crucial to maintain a clear understanding of the permissions structure to avoid `AuthorizationFailed` and `LinkedAuthorizationFailed` errors.
0 commit comments