Skip to content

Commit a8bd2ab

Browse files
ttorblettorble
authored
Merge pull request #287141 from rolyon/rolyon-rbac-roles-sept2024-refresh
[Azure RBAC] Refresh roles and permissions for September 2024
2 parents ce0748b + 7c6c852 commit a8bd2ab

21 files changed

+5240
-67
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 67 additions & 0 deletions
Large diffs are not rendered by default.

‎articles/role-based-access-control/built-in-roles/ai-machine-learning.md

Lines changed: 1040 additions & 57 deletions
Large diffs are not rendered by default.

‎articles/role-based-access-control/built-in-roles/analytics.md

Lines changed: 208 additions & 0 deletions
Large diffs are not rendered by default.

‎articles/role-based-access-control/built-in-roles/compute.md

Lines changed: 608 additions & 4 deletions
Large diffs are not rendered by default.

‎articles/role-based-access-control/built-in-roles/containers.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2082,6 +2082,47 @@ Allows read/write access to most objects in a namespace. This role does not allo
20822082
}
20832083
```
20842084

2085+
## Connected Cluster Managed Identity CheckAccess Reader
2086+
2087+
Built-in role that allows a Connected Cluster managed identity to call the checkAccess API
2088+
2089+
[Learn more](/azure/azure-arc/kubernetes/azure-rbac)
2090+
2091+
> [!div class="mx-tableFixed"]
2092+
> | Actions | Description |
2093+
> | --- | --- |
2094+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
2095+
> | **NotActions** | |
2096+
> | *none* | |
2097+
> | **DataActions** | |
2098+
> | *none* | |
2099+
> | **NotDataActions** | |
2100+
> | *none* | |
2101+
2102+
```json
2103+
{
2104+
"assignableScopes": [
2105+
"/"
2106+
],
2107+
"description": "Built-in role that allows a Connected Cluster managed identity to call the checkAccess API",
2108+
"id": "/providers/Microsoft.Authorization/roleDefinitions/65a14201-8f6c-4c28-bec4-12619c5a9aaa",
2109+
"name": "65a14201-8f6c-4c28-bec4-12619c5a9aaa",
2110+
"permissions": [
2111+
{
2112+
"actions": [
2113+
"Microsoft.Authorization/*/read"
2114+
],
2115+
"notActions": [],
2116+
"dataActions": [],
2117+
"notDataActions": []
2118+
}
2119+
],
2120+
"roleName": "Connected Cluster Managed Identity CheckAccess Reader",
2121+
"roleType": "BuiltInRole",
2122+
"type": "Microsoft.Authorization/roleDefinitions"
2123+
}
2124+
```
2125+
20852126
## Kubernetes Agentless Operator
20862127

20872128
Grants Microsoft Defender for Cloud access to Azure Kubernetes Services

‎articles/role-based-access-control/built-in-roles/databases.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,59 @@ Can manage Azure Cosmos DB accounts. Azure Cosmos DB is formerly known as Docume
334334
}
335335
```
336336

337+
## PostgreSQL Flexible Server Long Term Retention Backup Role
338+
339+
Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup.
340+
341+
[Learn more](/azure/backup/backup-azure-database-postgresql-flex-overview)
342+
343+
> [!div class="mx-tableFixed"]
344+
> | Actions | Description |
345+
> | --- | --- |
346+
> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/ltrBackupOperations/read | Returns the list of PostgreSQL server long term backup operation tracking. |
347+
> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/ltrPreBackup/action | Checks if a server is ready for a long term backup |
348+
> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/flexibleServers/startLtrBackup/action | Start long term backup for a server |
349+
> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/locations/azureAsyncOperation/read | Return PostgreSQL Server Operation Results |
350+
> | [Microsoft.DBforPostgreSQL](../permissions/databases.md#microsoftdbforpostgresql)/locations/operationResults/read | Return PostgreSQL Server Operation Results |
351+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
352+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
353+
> | **NotActions** | |
354+
> | *none* | |
355+
> | **DataActions** | |
356+
> | *none* | |
357+
> | **NotDataActions** | |
358+
> | *none* | |
359+
360+
```json
361+
{
362+
"assignableScopes": [
363+
"/"
364+
],
365+
"description": "Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup.",
366+
"id": "/providers/Microsoft.Authorization/roleDefinitions/c088a766-074b-43ba-90d4-1fb21feae531",
367+
"name": "c088a766-074b-43ba-90d4-1fb21feae531",
368+
"permissions": [
369+
{
370+
"actions": [
371+
"Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupOperations/read",
372+
"Microsoft.DBforPostgreSQL/flexibleServers/ltrPreBackup/action",
373+
"Microsoft.DBforPostgreSQL/flexibleServers/startLtrBackup/action",
374+
"Microsoft.DBforPostgreSQL/locations/azureAsyncOperation/read",
375+
"Microsoft.DBforPostgreSQL/locations/operationResults/read",
376+
"Microsoft.Resources/subscriptions/read",
377+
"Microsoft.Resources/subscriptions/resourceGroups/read"
378+
],
379+
"notActions": [],
380+
"dataActions": [],
381+
"notDataActions": []
382+
}
383+
],
384+
"roleName": "PostgreSQL Flexible Server Long Term Retention Backup Role",
385+
"roleType": "BuiltInRole",
386+
"type": "Microsoft.Authorization/roleDefinitions"
387+
}
388+
```
389+
337390
## Redis Cache Contributor
338391

339392
Lets you manage Redis caches, but not access to them.

‎articles/role-based-access-control/built-in-roles/devops.md

Lines changed: 284 additions & 0 deletions
Large diffs are not rendered by default.

‎articles/role-based-access-control/built-in-roles/hybrid-multicloud.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -764,6 +764,49 @@ Lets you manage Azure Stack registrations.
764764
}
765765
```
766766

767+
## Hybrid Server Resource Administrator
768+
769+
Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider.
770+
771+
[Learn more](/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-identity-and-access-management)
772+
773+
> [!div class="mx-tableFixed"]
774+
> | Actions | Description |
775+
> | --- | --- |
776+
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/* | |
777+
> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/*/read | |
778+
> | **NotActions** | |
779+
> | *none* | |
780+
> | **DataActions** | |
781+
> | *none* | |
782+
> | **NotDataActions** | |
783+
> | *none* | |
784+
785+
```json
786+
{
787+
"assignableScopes": [
788+
"/"
789+
],
790+
"description": "Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider.",
791+
"id": "/providers/Microsoft.Authorization/roleDefinitions/48b40c6e-82e0-4eb3-90d5-19e40f49b624",
792+
"name": "48b40c6e-82e0-4eb3-90d5-19e40f49b624",
793+
"permissions": [
794+
{
795+
"actions": [
796+
"Microsoft.HybridCompute/machines/*",
797+
"Microsoft.HybridCompute/*/read"
798+
],
799+
"notActions": [],
800+
"dataActions": [],
801+
"notDataActions": []
802+
}
803+
],
804+
"roleName": "Hybrid Server Resource Administrator",
805+
"roleType": "BuiltInRole",
806+
"type": "Microsoft.Authorization/roleDefinitions"
807+
}
808+
```
809+
767810
## Next steps
768811

769812
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)

0 commit comments

Comments
 (0)