Skip to content

Commit 733b4ee

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #292986 from rolyon/rolyon-rbac-roles-chaos-studio
[Azure RBAC] Chaos Studio roles
2 parents 1f0cb9d + 75f4c0b commit 733b4ee

File tree

2 files changed

+156
-0
lines changed

2 files changed

+156
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,9 @@ The following table provides a brief description of each built-in role. Click th
443443
> [!div class="mx-tableFixed"]
444444
> | Built-in role | Description | ID |
445445
> | --- | --- | --- |
446+
> | <a name='chaos-studio-experiment-contributor'></a>[Chaos Studio Experiment Contributor](./built-in-roles/devops.md#chaos-studio-experiment-contributor) | Can create, run, and see details for experiments, onboard targets, and manage capabilities. | 7c2e40b7-25eb-482a-82cb-78ba06cb46d5 |
447+
> | <a name='chaos-studio-operator'></a>[Chaos Studio Operator](./built-in-roles/devops.md#chaos-studio-operator) | Can run and see details for experiments but cannot create experiments or manage targets and capabilities. | 1a40e87e-6645-48e0-b27a-0b115d849a20 |
448+
> | <a name='chaos-studio-reader'></a>[Chaos Studio Reader](./built-in-roles/devops.md#chaos-studio-reader) | Can view targets, capabilities, experiments, and experiment details. | 29e2da8a-229c-4157-8ae8-cc72fc506b74 |
446449
> | <a name='deployment-environments-reader'></a>[Deployment Environments Reader](./built-in-roles/devops.md#deployment-environments-reader) | Provides read access to environment resources. | eb960402-bf75-4cc3-8d68-35b34f960f72 |
447450
> | <a name='deployment-environments-user'></a>[Deployment Environments User](./built-in-roles/devops.md#deployment-environments-user) | Provides access to manage environment resources. | 18e40d4e-8d2e-438d-97e1-9528336e149c |
448451
> | <a name='devcenter-dev-box-user'></a>[DevCenter Dev Box User](./built-in-roles/devops.md#devcenter-dev-box-user) | Provides access to create and manage dev boxes. | 45d50f46-0b78-4001-a660-4198cbe8cd05 |

‎articles/role-based-access-control/built-in-roles/devops.md

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,159 @@ ms.custom: generated
1616
This article lists the Azure built-in roles in the DevOps category.
1717

1818

19+
## Chaos Studio Experiment Contributor
20+
21+
Can create, run, and see details for experiments, onboard targets, and manage capabilities.
22+
23+
> [!div class="mx-tableFixed"]
24+
> | Actions | Description |
25+
> | --- | --- |
26+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/* | |
27+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
28+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
29+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
30+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
31+
> | **NotActions** | |
32+
> | *none* | |
33+
> | **DataActions** | |
34+
> | *none* | |
35+
> | **NotDataActions** | |
36+
> | *none* | |
37+
38+
```json
39+
{
40+
"assignableScopes": [
41+
"/"
42+
],
43+
"description": "Can create, run, and see details for experiments, onboard targets, and manage capabilities.",
44+
"id": "/providers/Microsoft.Authorization/roleDefinitions/7c2e40b7-25eb-482a-82cb-78ba06cb46d5",
45+
"name": "7c2e40b7-25eb-482a-82cb-78ba06cb46d5",
46+
"permissions": [
47+
{
48+
"actions": [
49+
"Microsoft.Chaos/*",
50+
"Microsoft.Authorization/*/read",
51+
"Microsoft.Insights/alertRules/*",
52+
"Microsoft.Resources/deployments/*",
53+
"Microsoft.Resources/subscriptions/resourceGroups/read"
54+
],
55+
"notActions": [],
56+
"dataActions": [],
57+
"notDataActions": []
58+
}
59+
],
60+
"roleName": "Chaos Studio Experiment Contributor",
61+
"roleType": "BuiltInRole",
62+
"type": "Microsoft.Authorization/roleDefinitions"
63+
}
64+
```
65+
66+
## Chaos Studio Operator
67+
68+
Can run and see details for experiments but cannot create experiments or manage targets and capabilities.
69+
70+
> [!div class="mx-tableFixed"]
71+
> | Actions | Description |
72+
> | --- | --- |
73+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/*/read | |
74+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/start/action | Starts a Chaos Experiment to inject faults. |
75+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/cancel/action | Cancels a running Chaos Experiment to stop the fault injection. |
76+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/executions/getExecutionDetails/action | Gets details of a chaos experiment execution for a given chaos experiment. |
77+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/locations/operationResults/read | Gets an Operation Result. |
78+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/locations/operationStatuses/read | Gets an Operation Status. |
79+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
80+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
81+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
82+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
83+
> | **NotActions** | |
84+
> | *none* | |
85+
> | **DataActions** | |
86+
> | *none* | |
87+
> | **NotDataActions** | |
88+
> | *none* | |
89+
90+
```json
91+
{
92+
"assignableScopes": [
93+
"/"
94+
],
95+
"description": "Can run and see details for experiments but cannot create experiments or manage targets and capabilities.",
96+
"id": "/providers/Microsoft.Authorization/roleDefinitions/1a40e87e-6645-48e0-b27a-0b115d849a20",
97+
"name": "1a40e87e-6645-48e0-b27a-0b115d849a20",
98+
"permissions": [
99+
{
100+
"actions": [
101+
"Microsoft.Chaos/*/read",
102+
"Microsoft.Chaos/experiments/start/action",
103+
"Microsoft.Chaos/experiments/cancel/action",
104+
"Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
105+
"Microsoft.Chaos/locations/operationResults/read",
106+
"Microsoft.Chaos/locations/operationStatuses/read",
107+
"Microsoft.Authorization/*/read",
108+
"Microsoft.Insights/alertRules/*",
109+
"Microsoft.Resources/deployments/*",
110+
"Microsoft.Resources/subscriptions/resourceGroups/read"
111+
],
112+
"notActions": [],
113+
"dataActions": [],
114+
"notDataActions": []
115+
}
116+
],
117+
"roleName": "Chaos Studio Operator",
118+
"roleType": "BuiltInRole",
119+
"type": "Microsoft.Authorization/roleDefinitions"
120+
}
121+
```
122+
123+
## Chaos Studio Reader
124+
125+
Can view targets, capabilities, experiments, and experiment details.
126+
127+
> [!div class="mx-tableFixed"]
128+
> | Actions | Description |
129+
> | --- | --- |
130+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/*/read | |
131+
> | [Microsoft.Chaos](../permissions/devops.md#microsoftchaos)/experiments/executions/getExecutionDetails/action | Gets details of a chaos experiment execution for a given chaos experiment. |
132+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
133+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
134+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
135+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
136+
> | **NotActions** | |
137+
> | *none* | |
138+
> | **DataActions** | |
139+
> | *none* | |
140+
> | **NotDataActions** | |
141+
> | *none* | |
142+
143+
```json
144+
{
145+
"assignableScopes": [
146+
"/"
147+
],
148+
"description": "Can view targets, capabilities, experiments, and experiment details.",
149+
"id": "/providers/Microsoft.Authorization/roleDefinitions/29e2da8a-229c-4157-8ae8-cc72fc506b74",
150+
"name": "29e2da8a-229c-4157-8ae8-cc72fc506b74",
151+
"permissions": [
152+
{
153+
"actions": [
154+
"Microsoft.Chaos/*/read",
155+
"Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
156+
"Microsoft.Authorization/*/read",
157+
"Microsoft.Insights/alertRules/*",
158+
"Microsoft.Resources/deployments/*",
159+
"Microsoft.Resources/subscriptions/resourceGroups/read"
160+
],
161+
"notActions": [],
162+
"dataActions": [],
163+
"notDataActions": []
164+
}
165+
],
166+
"roleName": "Chaos Studio Reader",
167+
"roleType": "BuiltInRole",
168+
"type": "Microsoft.Authorization/roleDefinitions"
169+
}
170+
```
171+
19172
## Deployment Environments Reader
20173

21174
Provides read access to environment resources.

0 commit comments

Comments
 (0)