Skip to content

Commit 77c2b38

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #157831 from MikeDodaro/getJSON
How to get JSON source for permissions.
2 parents ddce425 + fe04261 commit 77c2b38

File tree

5 files changed

+235
-7
lines changed

5 files changed

+235
-7
lines changed

‎articles/spring-cloud/how-to-permissions.md

Lines changed: 235 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,11 @@ The developer role includes permissions to restart apps and see their log stream
3636

3737
Follow these steps to start defining a role.
3838

39-
1. In the Azure portal, open the subscription and resource group where you want the custom role to be assignable.
39+
1. In the Azure portal, open the subscription where you want the custom role to be assignable.
4040
2. Open **Access control (IAM)**.
4141
3. Click **+ Add**.
4242
4. Click **Add custom role**.
43+
#### [Portal](#tab/Azure-portal)
4344
5. Click **Next**.
4445

4546
![Create custom role](media/spring-cloud-permissions/create-custom-role.png)
@@ -92,14 +93,69 @@ From **Microsoft.AppPlatform/locations/operationStatus/operationId**, select:
9293

9394
9. Click **Add**.
9495

96+
#### [JSON](#tab/JSON)
97+
5. Click **Next**.
98+
99+
6. Click the **JSON** tab.
100+
101+
7. Click **Edit**, and delete the default text.
102+
103+
![Edit custom role](media/spring-cloud-permissions/create-custom-role-edit-json.png)
104+
105+
8. Paste the following JSON to define the Developer role.
106+
107+
![Create custom role](media/spring-cloud-permissions/create-custom-role-json.png)
108+
109+
```json
110+
{
111+
"properties": {
112+
"roleName": "Developer",
113+
"description": "",
114+
"assignableScopes": [
115+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
116+
],
117+
"permissions": [
118+
{
119+
"actions": [
120+
"Microsoft.AppPlatform/Spring/write",
121+
"Microsoft.AppPlatform/Spring/read",
122+
"Microsoft.AppPlatform/Spring/listTestKeys/action",
123+
"Microsoft.AppPlatform/Spring/apps/read",
124+
"Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
125+
"Microsoft.AppPlatform/Spring/apps/bindings/read",
126+
"Microsoft.AppPlatform/Spring/apps/domains/read",
127+
"Microsoft.AppPlatform/Spring/apps/deployments/write",
128+
"Microsoft.AppPlatform/Spring/apps/deployments/read",
129+
"Microsoft.AppPlatform/Spring/apps/deployments/start/action",
130+
"Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
131+
"Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
132+
"Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
133+
"Microsoft.AppPlatform/Spring/certificates/read",
134+
"Microsoft.AppPlatform/locations/operationResults/Spring/read",
135+
"Microsoft.AppPlatform/locations/operationStatus/operationId/read"
136+
],
137+
"notActions": [],
138+
"dataActions": [],
139+
"notDataActions": []
140+
}
141+
]
142+
}
143+
}
144+
```
145+
9. Click **Save**.
146+
---
147+
95148
10. Review the permissions.
96149

97150
11. Click **Review and create**.
98151

99152
## Define DevOps engineer role
100153
This procedure defines a role with permissions to deploy, test, and restart Azure Spring Cloud apps.
101154

102-
1. Repeat the procedure to navigate subscription, resource group,and access Access control (IAM).
155+
1. Repeat the procedure to navigate subscription and access Access control (IAM).
156+
157+
#### [Portal](#tab/Azure-portal)
158+
103159
2. Select the permissions for the DevOps engineer role:
104160

105161
From **Microsoft.AppPlatform/Spring**, select:
@@ -155,10 +211,74 @@ From **Microsoft.AppPlatform/skus**, select:
155211

156212
5. Click **Review and create**.
157213

214+
#### [JSON](#tab/JSON)
215+
216+
2. Click **Next**.
217+
218+
3. Click the **JSON** tab.
219+
220+
4. Click **Edit**, and delete the default text.
221+
222+
![Edit custom role](media/spring-cloud-permissions/create-custom-role-edit-json.png)
223+
224+
5. Paste the following JSON to define the DevOps engineer role.
225+
226+
```json
227+
{
228+
"properties": {
229+
"roleName": "DevOps engineer",
230+
"description": "",
231+
"assignableScopes": [
232+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
233+
],
234+
"permissions": [
235+
{
236+
"actions": [
237+
"Microsoft.AppPlatform/Spring/write",
238+
"Microsoft.AppPlatform/Spring/delete",
239+
"Microsoft.AppPlatform/Spring/read",
240+
"Microsoft.AppPlatform/Spring/enableTestEndpoint/action",
241+
"Microsoft.AppPlatform/Spring/disableTestEndpoint/action",
242+
"Microsoft.AppPlatform/Spring/listTestKeys/action",
243+
"Microsoft.AppPlatform/Spring/regenerateTestKey/action",
244+
"Microsoft.AppPlatform/Spring/apps/write",
245+
"Microsoft.AppPlatform/Spring/apps/delete",
246+
"Microsoft.AppPlatform/Spring/apps/read",
247+
"Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
248+
"Microsoft.AppPlatform/Spring/apps/validateDomain/action",
249+
"Microsoft.AppPlatform/Spring/apps/bindings/write",
250+
"Microsoft.AppPlatform/Spring/apps/bindings/delete",
251+
"Microsoft.AppPlatform/Spring/apps/bindings/read",
252+
"Microsoft.AppPlatform/Spring/apps/deployments/write",
253+
"Microsoft.AppPlatform/Spring/apps/deployments/delete",
254+
"Microsoft.AppPlatform/Spring/apps/deployments/read",
255+
"Microsoft.AppPlatform/Spring/apps/deployments/start/action",
256+
"Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
257+
"Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
258+
"Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
259+
"Microsoft.AppPlatform/Spring/apps/deployments/skus/read",
260+
"Microsoft.AppPlatform/locations/checkNameAvailability/action",
261+
"Microsoft.AppPlatform/locations/operationResults/Spring/read",
262+
"Microsoft.AppPlatform/locations/operationStatus/operationId/read",
263+
"Microsoft.AppPlatform/skus/read"
264+
],
265+
"notActions": [],
266+
"dataActions": [],
267+
"notDataActions": []
268+
}
269+
]
270+
}
271+
}
272+
```
273+
6. Review the permissions.
274+
275+
7. Click **Review and create**.
276+
---
158277
## Define Ops - Site Reliability Engineering role
159278
This procedure defines a role with permissions to deploy, test, and restart Azure Spring Cloud apps.
160279

161-
1. Repeat the procedure to navigate subscription, resource group,and access Access control (IAM).
280+
1. Repeat the procedure to navigate subscription and access Access control (IAM).
281+
#### [Portal](#tab/Azure-portal)
162282

163283
2. Select the permissions for the Ops - Site Reliability Engineering role:
164284

@@ -189,10 +309,58 @@ From **Microsoft.AppPlatform/locations/operationStatus/operationId**, select:
189309

190310
5. Click **Review and create**.
191311

312+
#### [JSON](#tab/JSON)
313+
314+
2. Click **Next**.
315+
316+
3. Click the **JSON** tab.
317+
318+
4. Click **Edit**, and delete the default text.
319+
320+
![Edit custom role](media/spring-cloud-permissions/create-custom-role-edit-json.png)
321+
322+
5. Paste the following JSON to define the Ops - Site Reliability Engineering role.
323+
324+
```json
325+
{
326+
"properties": {
327+
"roleName": "Ops - Site Reliability Engineering",
328+
"description": "",
329+
"assignableScopes": [
330+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
331+
],
332+
"permissions": [
333+
{
334+
"actions": [
335+
"Microsoft.AppPlatform/Spring/read",
336+
"Microsoft.AppPlatform/Spring/listTestKeys/action",
337+
"Microsoft.AppPlatform/Spring/apps/read",
338+
"Microsoft.AppPlatform/Spring/apps/deployments/read",
339+
"Microsoft.AppPlatform/Spring/apps/deployments/start/action",
340+
"Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
341+
"Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
342+
"Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
343+
"Microsoft.AppPlatform/locations/operationResults/Spring/read",
344+
"Microsoft.AppPlatform/locations/operationStatus/operationId/read"
345+
],
346+
"notActions": [],
347+
"dataActions": [],
348+
"notDataActions": []
349+
}
350+
]
351+
}
352+
}
353+
```
354+
6. Review the permissions.
355+
356+
7. Click **Review and create**.
357+
---
192358
## Define Azure Pipelines/Provisioning role
193-
This Jenkins/GitHub Actions role can create and configure everything in Azure Spring Cloud and apps with a service instance. This role is for releasing or deploying code.
194359

195-
1. Repeat the procedure to navigate subscription, resource group, and access Access control (IAM).
360+
This Jenkins/Github Actions role can create and configure everything in Azure Spring Cloud and apps with a service instance. This role is for releasing or deploying code.
361+
362+
1. Repeat the procedure to navigate subscription and access Access control (IAM).
363+
#### [Portal](#tab/Azure-portal)
196364

197365
2. Open the **Permissions** options.
198366

@@ -250,8 +418,68 @@ From **Microsoft.AppPlatform/skus**, select:
250418
5. Review the permissions.
251419

252420
6. Click **Review and create**.
253-
254-
421+
#### [JSON](#tab/JSON)
422+
423+
2. Click **Next**.
424+
425+
3. Click the **JSON** tab.
426+
427+
4. Click **Edit**, and delete the default text.
428+
429+
![Edit custom role](media/spring-cloud-permissions/create-custom-role-edit-json.png)
430+
431+
5. Paste the following JSON to define the Azure Pipelines/Provisioning role.
432+
433+
```json
434+
{
435+
"properties": {
436+
"roleName": "Azure Pipelines/Provisioning",
437+
"description": "",
438+
"assignableScopes": [
439+
"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
440+
],
441+
"permissions": [
442+
{
443+
"actions": [
444+
"Microsoft.AppPlatform/Spring/write",
445+
"Microsoft.AppPlatform/Spring/delete",
446+
"Microsoft.AppPlatform/Spring/read",
447+
"Microsoft.AppPlatform/Spring/enableTestEndpoint/action",
448+
"Microsoft.AppPlatform/Spring/disableTestEndpoint/action",
449+
"Microsoft.AppPlatform/Spring/listTestKeys/action",
450+
"Microsoft.AppPlatform/Spring/regenerateTestKey/action",
451+
"Microsoft.AppPlatform/Spring/apps/write",
452+
"Microsoft.AppPlatform/Spring/apps/delete",
453+
"Microsoft.AppPlatform/Spring/apps/read",
454+
"Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
455+
"Microsoft.AppPlatform/Spring/apps/validateDomain/action",
456+
"Microsoft.AppPlatform/Spring/apps/bindings/write",
457+
"Microsoft.AppPlatform/Spring/apps/bindings/delete",
458+
"Microsoft.AppPlatform/Spring/apps/bindings/read",
459+
"Microsoft.AppPlatform/Spring/apps/deployments/write",
460+
"Microsoft.AppPlatform/Spring/apps/deployments/delete",
461+
"Microsoft.AppPlatform/Spring/apps/deployments/read",
462+
"Microsoft.AppPlatform/Spring/apps/deployments/start/action",
463+
"Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
464+
"Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
465+
"Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
466+
"Microsoft.AppPlatform/skus/read",
467+
"Microsoft.AppPlatform/locations/checkNameAvailability/action",
468+
"Microsoft.AppPlatform/locations/operationResults/Spring/read",
469+
"Microsoft.AppPlatform/locations/operationStatus/operationId/read"
470+
],
471+
"notActions": [],
472+
"dataActions": [],
473+
"notDataActions": []
474+
}
475+
]
476+
}
477+
}
478+
```
479+
6. Click **Add**.
480+
481+
7. Review the permissions.
482+
---
255483
## See also
256484
* [Create or update Azure custom roles using the Azure portal](../role-based-access-control/custom-roles-portal.md)
257485

‎articles/spring-cloud/media/spring-cloud-permissions/create-custom-role-edit-json.png

64.5 KB
Loading

‎articles/spring-cloud/media/spring-cloud-permissions/create-custom-role-json.png

109 KB
Loading

‎articles/spring-cloud/media/spring-cloud-permissions/create-custom-role.png

39 KB
Loading

‎articles/spring-cloud/media/spring-cloud-permissions/json-source.png

25.6 KB
Loading

0 commit comments

Comments
 (0)