Skip to content

Commit bcb715c

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #279820 from rolyon/rolyon-rbac-roles-compute-gallery
[Azure RBAC] Compute Gallery roles
2 parents 6f3a00b + 846097d commit bcb715c

File tree

2 files changed

+104
-0
lines changed

2 files changed

+104
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ The following table provides a brief description of each built-in role. Click th
3737
> | Built-in role | Description | ID |
3838
> | --- | --- | --- |
3939
> | <a name='classic-virtual-machine-contributor'></a>[Classic Virtual Machine Contributor](./built-in-roles/compute.md#classic-virtual-machine-contributor) | Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to. | d73bb868-a0df-4d4d-bd69-98a00b01fccb |
40+
> | <a name='compute-gallery-artifacts-publisher'></a>[Compute Gallery Artifacts Publisher](./built-in-roles/compute.md#compute-gallery-artifacts-publisher) | This is the role for publishing gallery artifacts. | 85a2d0d9-2eba-4c9c-b355-11c2cc0788ab |
41+
> | <a name='compute-gallery-sharing-admin'></a>[Compute Gallery Sharing Admin](./built-in-roles/compute.md#compute-gallery-sharing-admin) | This role allows user to share gallery to another subscription/tenant or share it to the public. | 1ef6a3be-d0ac-425d-8c01-acb62866290b |
4042
> | <a name='data-operator-for-managed-disks'></a>[Data Operator for Managed Disks](./built-in-roles/compute.md#data-operator-for-managed-disks) | Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication. | 959f8984-c045-4866-89c7-12bf9737be2e |
4143
> | <a name='desktop-virtualization-application-group-contributor'></a>[Desktop Virtualization Application Group Contributor](./built-in-roles/compute.md#desktop-virtualization-application-group-contributor) | Contributor of the Desktop Virtualization Application Group. | 86240b0e-9422-4c43-887b-b61143f32ba8 |
4244
> | <a name='desktop-virtualization-application-group-reader'></a>[Desktop Virtualization Application Group Reader](./built-in-roles/compute.md#desktop-virtualization-application-group-reader) | Reader of the Desktop Virtualization Application Group. | aebf23d0-b568-4e86-b8f9-fe83a2c6ab55 |

‎articles/role-based-access-control/built-in-roles/compute.md

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,108 @@ Lets you manage classic virtual machines, but not access to them, and not the vi
8787
}
8888
```
8989

90+
## Compute Gallery Artifacts Publisher
91+
92+
This is the role for publishing gallery artifacts.
93+
94+
> [!div class="mx-tableFixed"]
95+
> | Actions | Description |
96+
> | --- | --- |
97+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/* | |
98+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/capsOperations/read | Gets the status of an asynchronous Caps operation |
99+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/communityGalleries/* | |
100+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/sharedGalleries/* | |
101+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/images/* | |
102+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |
103+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/write | Creates a new Disk or updates an existing one |
104+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
105+
> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
106+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
107+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
108+
> | **NotActions** | |
109+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
110+
> | **DataActions** | |
111+
> | *none* | |
112+
> | **NotDataActions** | |
113+
> | *none* | |
114+
115+
```json
116+
{
117+
"assignableScopes": [
118+
"/"
119+
],
120+
"description": "This is the role for publishing gallery artifacts.",
121+
"id": "/providers/Microsoft.Authorization/roleDefinitions/85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
122+
"name": "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
123+
"permissions": [
124+
{
125+
"actions": [
126+
"Microsoft.Compute/galleries/*",
127+
"Microsoft.Compute/locations/capsOperations/read",
128+
"Microsoft.Compute/locations/communityGalleries/*",
129+
"Microsoft.Compute/locations/sharedGalleries/*",
130+
"Microsoft.Compute/images/*",
131+
"Microsoft.Compute/virtualMachines/write",
132+
"Microsoft.Compute/disks/write",
133+
"Microsoft.Authorization/*/read",
134+
"Microsoft.Insights/alertRules/*",
135+
"Microsoft.Resources/deployments/*",
136+
"Microsoft.Resources/subscriptions/resourceGroups/read"
137+
],
138+
"notActions": [
139+
"Microsoft.Compute/galleries/share/action"
140+
],
141+
"dataActions": [],
142+
"notDataActions": []
143+
}
144+
],
145+
"roleName": "Compute Gallery Artifacts Publisher",
146+
"roleType": "BuiltInRole",
147+
"type": "Microsoft.Authorization/roleDefinitions"
148+
}
149+
```
150+
151+
## Compute Gallery Sharing Admin
152+
153+
This role allows user to share gallery to another subscription/tenant or share it to the public.
154+
155+
[Learn more](/azure/virtual-machines/create-gallery)
156+
157+
> [!div class="mx-tableFixed"]
158+
> | Actions | Description |
159+
> | --- | --- |
160+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
161+
> | **NotActions** | |
162+
> | *none* | |
163+
> | **DataActions** | |
164+
> | *none* | |
165+
> | **NotDataActions** | |
166+
> | *none* | |
167+
168+
```json
169+
{
170+
"assignableScopes": [
171+
"/"
172+
],
173+
"description": "This role allows user to share gallery to another subscription/tenant or share it to the public.",
174+
"id": "/providers/Microsoft.Authorization/roleDefinitions/1ef6a3be-d0ac-425d-8c01-acb62866290b",
175+
"name": "1ef6a3be-d0ac-425d-8c01-acb62866290b",
176+
"permissions": [
177+
{
178+
"actions": [
179+
"Microsoft.Compute/galleries/share/action"
180+
],
181+
"notActions": [],
182+
"dataActions": [],
183+
"notDataActions": []
184+
}
185+
],
186+
"roleName": "Compute Gallery Sharing Admin",
187+
"roleType": "BuiltInRole",
188+
"type": "Microsoft.Authorization/roleDefinitions"
189+
}
190+
```
191+
90192
## Data Operator for Managed Disks
91193

92194
Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.

0 commit comments

Comments
 (0)