|
| 1 | +--- |
| 2 | +title: Azure Role-Based Access Control for Firmware analysis |
| 3 | +description: Learn about how to use Azure Role-Based Access Control for Firmware Analysis. |
| 4 | +author: karengu0 |
| 5 | +ms.author: karenguo |
| 6 | +ms.topic: conceptual |
| 7 | +ms.date: 01/10/2024 |
| 8 | +--- |
| 9 | + |
| 10 | +# Overview of Azure Role-Based Access Control for Firmware analysis |
| 11 | +As a user of Firmware analysis, you may want to manage access to your firmware image analysis results. Azure Role-Based Access Control (RBAC) is an authorization system that enables you to control who has access to your analysis results, what permissions they have, and at what level of the resource hierarchy. This article explains how to store firmware analysis results in Azure, manage access permissions, and use RBAC to share these results within your organization and with third parties. To learn more about Azure RBAC, visit [What is Azure Role-Based Access Control (Azure RBAC)?](./../role-based-access-control/overview.md). |
| 12 | + |
| 13 | +## Roles |
| 14 | +Roles are a collection of permissions packaged together. There are two types of roles: |
| 15 | + |
| 16 | +* **Job function roles** give users permission to perform specific job functions or tasks, such as **Key Vault Contributor** or **Azure Kubernetes Service Cluster Monitoring User**. |
| 17 | +* **Privileged administrator roles** give elevated access privileges, such as **Owner**, **Contributor**, or **User Access Administrator**. To learn more about roles, visit [Azure built-in roles](./../role-based-access-control/built-in-roles.md). |
| 18 | + |
| 19 | +In Firmware analysis, the most common roles are Owner, Contributor, Security Admin, and Firmware Analysis Admin. Learn more about [which roles you need for different permissions](./firmware-analysis-rbac.md#firmware-analysis-roles-scopes-and-capabilities), such as uploading firmware images or sharing firmware analysis results. |
| 20 | + |
| 21 | +## Understanding the Representation of Firmware Images in the Azure Resource Hierarchy |
| 22 | +Azure organizes resources into resource hierarchies, which are in a top-down structure, and you can assign roles at each level of the hierarchy. The level at which you assign a role is the "scope," and lower scopes may inherit roles assigned at higher scopes. Learn more about the [levels of hierarchy and how to organize your resources in the hierarchy](/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources). |
| 23 | + |
| 24 | +When you onboard your subscription to Firmware analysis and select your resource group, the action automatically creates the **default** resource within your resource group. |
| 25 | + |
| 26 | +Navigate to your resource group and select **Show hidden types** to show the **default** resource. The **default** resource has the **Microsoft.IoTFirmwareDefense.workspaces** type. |
| 27 | + |
| 28 | +:::image type="content" source="media/firmware-analysis-rbac/default-workspace.png" alt-text="Screenshot of the toggle button 'Show hidden types' that reveals a resource named 'default'." lightbox="media/firmware-analysis-rbac/default-workspace.png"::: |
| 29 | + |
| 30 | +Although the **default** workspace resource isn't something that you'll regularly interact with, each firmware image that you upload will be represented as a resource and stored here. |
| 31 | + |
| 32 | +You can use RBAC at each level of the hierarchy, including at the hidden **default Firmware Analysis Workspace** resource level. |
| 33 | + |
| 34 | +Here's the resource hierarchy of Firmware Analysis: |
| 35 | + |
| 36 | +:::image type="content" source="media/firmware-analysis-rbac/resource-hierarchy.png" alt-text="Diagram that shows the resource hierarchy of firmware images of Firmware Analysis." lightbox="media/firmware-analysis-rbac/resource-hierarchy.png"::: |
| 37 | + |
| 38 | +## Apply Azure RBAC |
| 39 | + |
| 40 | +> [!Note] |
| 41 | +> To begin using Firmware analysis, the user that onboards the subscription onto Firmware analysis ***must be*** an Owner, Contributor, Firmware Analysis Admin, or Security Admin at the subscription level. Follow the tutorial at [Analyze a firmware image with Firmware analysis](./tutorial-analyze-firmware.md#onboard-your-subscription-to-use-firmware-analysis) to onboard your subscription. Once you've onboarded your subscription, a user only needs to be a Firmware Analysis Admin to use Firmware Analysis. |
| 42 | +> |
| 43 | +
|
| 44 | +As a user of Firmware analysis, you may need to perform certain actions for your organization, such as uploading firmware images or sharing analysis results. |
| 45 | + |
| 46 | +Actions like these involve Role-Based Access Control (RBAC). To effectively use RBAC for Firmware analysis, you must know what your role assignment is, and at what scope. Knowing this information will inform you about what permissions you have, and thus whether you can complete certain actions. To check your role assignment, refer to [Check access for a user to a single Azure resource - Azure RBAC](./../role-based-access-control/check-access.md). Next, see the following table to check what roles and scopes are necessary for certain actions. |
| 47 | + |
| 48 | +### Common roles in Firmware analysis |
| 49 | + |
| 50 | +This table categorizes each role and provides a brief description of their permissions: |
| 51 | + |
| 52 | +**Role** | **Category** | **Description** |
| 53 | +---|---|--- |
| 54 | +**Owner** | Privileged administrator role | Grants full access to manage all resources, including the ability to assign roles in Azure RBAC. |
| 55 | +**Contributor** | Privileged administrator role | Grants full access to manage all resources, but doesn't allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries. |
| 56 | +**Security Admin** | Job function role | Allows the user to upload and analyze firmware images, add/assign security initiatives, and edit the security policy. [Learn more](/azure/defender-for-cloud/permissions). |
| 57 | +**Firmware Analysis Admin** | Job function role | Allows the user to upload and analyze firmware images. The user has no access beyond firmware analysis (can't access other resources in the subscription, create or delete resources, or invite other users). |
| 58 | + |
| 59 | +## Firmware analysis roles, scopes, and capabilities |
| 60 | + |
| 61 | +The following table summarizes what roles you need to perform certain actions. These roles and permissions apply at the Subscription and Resource Group levels, unless otherwise stated. |
| 62 | + |
| 63 | +**Action** | **Role required** |
| 64 | +:---|:--- |
| 65 | +Analyze firmware | Owner, Contributor, Security Admin, or Firmware Analysis Admin |
| 66 | +Invite third party users to see firmware analysis results | Owner |
| 67 | +Invite users to the Subscription | Owner at the **Subscription** level (Owner at the Resource Group level **cannot** invite users to the Subscription) |
| 68 | + |
| 69 | +## Uploading Firmware images |
| 70 | +To upload firmware images: |
| 71 | + |
| 72 | +* Confirm that you have sufficient permission in [Firmware Analysis Roles, Scopes, and Capabilities](#firmware-analysis-roles-scopes-and-capabilities). |
| 73 | +* [Upload a firmware image for analysis](./tutorial-analyze-firmware.md#upload-a-firmware-image-for-analysis). |
| 74 | + |
| 75 | +## Invite third parties to interact with your firmware analysis results |
| 76 | +You might want to invite someone to interact solely with your firmware analysis results, without allowing access to other parts of your organization (like other resource groups within your subscription). To allow this type of access, invite the user as a Firmware Analysis Admin at the Resource Group level. |
| 77 | + |
| 78 | +To invite a third party, follow the [Assign Azure roles to external guest users using the Azure portal](./../role-based-access-control/role-assignments-external-users.md#invite-an-external-user-to-your-directory) tutorial. |
| 79 | + |
| 80 | +* In step 3, navigate to your resource group. |
| 81 | +* In step 7, select the **Firmware Analysis Admin** role. |
| 82 | + |
| 83 | +> [!Note] |
| 84 | +> If you received an email to join an organization, be sure to check your Junk folder for the invitation email if you don't see it in your inbox. |
| 85 | +> |
0 commit comments