Skip to content

Commit cd24111

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #274603 from rolyon/rolyon-rbac-roles-azure-container-storage
[Azure RBAC] Azure Container Storage roles
2 parents 2404a1d + 25d2eba commit cd24111

File tree

2 files changed

+246
-2
lines changed

2 files changed

+246
-2
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: amycolannino
99
ms.author: rolyon
10-
ms.date: 04/25/2024
10+
ms.date: 05/07/2024
1111
ms.custom: generated
1212
---
1313

@@ -161,6 +161,9 @@ The following table provides a brief description of each built-in role. Click th
161161
> | <a name='azure-arc-kubernetes-cluster-admin'></a>[Azure Arc Kubernetes Cluster Admin](./built-in-roles/containers.md#azure-arc-kubernetes-cluster-admin) | Lets you manage all resources in the cluster. | 8393591c-06b9-48a2-a542-1bd6b377f6a2 |
162162
> | <a name='azure-arc-kubernetes-viewer'></a>[Azure Arc Kubernetes Viewer](./built-in-roles/containers.md#azure-arc-kubernetes-viewer) | Lets you view all resources in cluster/namespace, except secrets. | 63f0a09d-1495-4db4-a681-037d84835eb4 |
163163
> | <a name='azure-arc-kubernetes-writer'></a>[Azure Arc Kubernetes Writer](./built-in-roles/containers.md#azure-arc-kubernetes-writer) | Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings. | 5b999177-9696-4545-85c7-50de3797e5a1 |
164+
> | <a name='azure-container-storage-contributor'></a>[Azure Container Storage Contributor](./built-in-roles/containers.md#azure-container-storage-contributor) | Install Azure Container Storage and manage its storage resources. Includes an ABAC condition to constrain role assignments. | 95dd08a6-00bd-4661-84bf-f6726f83a4d0 |
165+
> | <a name='azure-container-storage-operator'></a>[Azure Container Storage Operator](./built-in-roles/containers.md#azure-container-storage-operator) | Enable a managed identity to perform Azure Container Storage operations, such as manage virtual machines and manage virtual networks. | 08d4c71a-cc63-4ce4-a9c8-5dd251b4d619 |
166+
> | <a name='azure-container-storage-owner'></a>[Azure Container Storage Owner](./built-in-roles/containers.md#azure-container-storage-owner) | Install Azure Container Storage, grant access to its storage resources, and configure Azure Elastic storage area network (SAN). Includes an ABAC condition to constrain role assignments. | 95de85bd-744d-4664-9dde-11430bc34793 |
164167
> | <a name='azure-kubernetes-fleet-manager-contributor-role'></a>[Azure Kubernetes Fleet Manager Contributor Role](./built-in-roles/containers.md#azure-kubernetes-fleet-manager-contributor-role) | Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc. | 63bb64ad-9799-4770-b5c3-24ed299a07bf |
165168
> | <a name='azure-kubernetes-fleet-manager-rbac-admin'></a>[Azure Kubernetes Fleet Manager RBAC Admin](./built-in-roles/containers.md#azure-kubernetes-fleet-manager-rbac-admin) | Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces. | 434fb43a-c01c-447e-9f67-c3ad923cfaba |
166169
> | <a name='azure-kubernetes-fleet-manager-rbac-cluster-admin'></a>[Azure Kubernetes Fleet Manager RBAC Cluster Admin](./built-in-roles/containers.md#azure-kubernetes-fleet-manager-rbac-cluster-admin) | Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster. | 18ab4d3d-a1bf-4477-8ad9-8359bc988f69 |

‎articles/role-based-access-control/built-in-roles/containers.md

Lines changed: 242 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: rolyon
88
manager: amycolannino
99
ms.author: rolyon
10-
ms.date: 04/25/2024
10+
ms.date: 05/07/2024
1111
ms.custom: generated
1212
---
1313

@@ -727,6 +727,247 @@ Lets you update everything in cluster/namespace, except (cluster)roles and (clus
727727
}
728728
```
729729

730+
## Azure Container Storage Contributor
731+
732+
Install Azure Container Storage and manage its storage resources. Includes an ABAC condition to constrain role assignments.
733+
734+
> [!div class="mx-tableFixed"]
735+
> | Actions | Description |
736+
> | --- | --- |
737+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/write | Creates or updates extension resource. |
738+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |
739+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/delete | Deletes extension instance resource. |
740+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/operations/read | Gets Async Operation status. |
741+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
742+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
743+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
744+
> | [Microsoft.Management](../permissions/management-and-governance.md#microsoftmanagement)/managementGroups/read | List management groups for the authenticated user. |
745+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
746+
> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
747+
> | **NotActions** | |
748+
> | *none* | |
749+
> | **DataActions** | |
750+
> | *none* | |
751+
> | **NotDataActions** | |
752+
> | *none* | |
753+
> | **Actions** | |
754+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
755+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
756+
> | **NotActions** | |
757+
> | *none* | |
758+
> | **DataActions** | |
759+
> | *none* | |
760+
> | **NotDataActions** | |
761+
> | *none* | |
762+
> | **Condition** | |
763+
> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) | Add or remove role assignments for the following roles:<br/>Azure Container Storage Operator |
764+
765+
```json
766+
{
767+
"assignableScopes": [
768+
"/"
769+
],
770+
"description": "Lets you install Azure Container Storage and manage its storage resources",
771+
"id": "/providers/Microsoft.Authorization/roleDefinitions/95dd08a6-00bd-4661-84bf-f6726f83a4d0",
772+
"name": "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
773+
"permissions": [
774+
{
775+
"actions": [
776+
"Microsoft.KubernetesConfiguration/extensions/write",
777+
"Microsoft.KubernetesConfiguration/extensions/read",
778+
"Microsoft.KubernetesConfiguration/extensions/delete",
779+
"Microsoft.KubernetesConfiguration/extensions/operations/read",
780+
"Microsoft.Authorization/*/read",
781+
"Microsoft.Resources/subscriptions/resourceGroups/read",
782+
"Microsoft.Resources/subscriptions/read",
783+
"Microsoft.Management/managementGroups/read",
784+
"Microsoft.Resources/deployments/*",
785+
"Microsoft.Support/*"
786+
],
787+
"notActions": [],
788+
"dataActions": [],
789+
"notDataActions": []
790+
},
791+
{
792+
"actions": [
793+
"Microsoft.Authorization/roleAssignments/write",
794+
"Microsoft.Authorization/roleAssignments/delete"
795+
],
796+
"notActions": [],
797+
"dataActions": [],
798+
"notDataActions": [],
799+
"conditionVersion": "2.0",
800+
"condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
801+
}
802+
],
803+
"roleName": "Azure Container Storage Contributor",
804+
"roleType": "BuiltInRole",
805+
"type": "Microsoft.Authorization/roleDefinitions"
806+
}
807+
```
808+
809+
## Azure Container Storage Operator
810+
811+
Enable a managed identity to perform Azure Container Storage operations, such as manage virtual machines and manage virtual networks.
812+
813+
> [!div class="mx-tableFixed"]
814+
> | Actions | Description |
815+
> | --- | --- |
816+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/elasticSans/* | |
817+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/locations/asyncoperations/read | Polls the status of an asynchronous operation. |
818+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/join/action | Joins a route table. Not Alertable. |
819+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
820+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/write | Creates a virtual network or updates an existing virtual network |
821+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/delete | Deletes a virtual network |
822+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/join/action | Joins a virtual network. Not Alertable. |
823+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
824+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |
825+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |
826+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |
827+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachineScaleSets/read | Get the properties of a Virtual Machine Scale Set |
828+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachineScaleSets/write | Creates a new Virtual Machine Scale Set or updates an existing one |
829+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachineScaleSets/virtualMachines/write | Updates the properties of a Virtual Machine in a VM Scale Set |
830+
> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachineScaleSets/virtualMachines/read | Retrieves the properties of a Virtual Machine in a VM Scale Set |
831+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/providers/read | Gets or lists resource providers. |
832+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
833+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
834+
> | **NotActions** | |
835+
> | *none* | |
836+
> | **DataActions** | |
837+
> | *none* | |
838+
> | **NotDataActions** | |
839+
> | *none* | |
840+
841+
```json
842+
{
843+
"assignableScopes": [
844+
"/"
845+
],
846+
"description": "Role required by a Managed Identity for Azure Container Storage operations",
847+
"id": "/providers/Microsoft.Authorization/roleDefinitions/08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
848+
"name": "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
849+
"permissions": [
850+
{
851+
"actions": [
852+
"Microsoft.ElasticSan/elasticSans/*",
853+
"Microsoft.ElasticSan/locations/asyncoperations/read",
854+
"Microsoft.Network/routeTables/join/action",
855+
"Microsoft.Network/networkSecurityGroups/join/action",
856+
"Microsoft.Network/virtualNetworks/write",
857+
"Microsoft.Network/virtualNetworks/delete",
858+
"Microsoft.Network/virtualNetworks/join/action",
859+
"Microsoft.Network/virtualNetworks/subnets/read",
860+
"Microsoft.Network/virtualNetworks/subnets/write",
861+
"Microsoft.Compute/virtualMachines/read",
862+
"Microsoft.Compute/virtualMachines/write",
863+
"Microsoft.Compute/virtualMachineScaleSets/read",
864+
"Microsoft.Compute/virtualMachineScaleSets/write",
865+
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
866+
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
867+
"Microsoft.Resources/subscriptions/providers/read",
868+
"Microsoft.Resources/subscriptions/resourceGroups/read",
869+
"Microsoft.Network/virtualNetworks/read"
870+
],
871+
"notActions": [],
872+
"dataActions": [],
873+
"notDataActions": []
874+
}
875+
],
876+
"roleName": "Azure Container Storage Operator",
877+
"roleType": "BuiltInRole",
878+
"type": "Microsoft.Authorization/roleDefinitions"
879+
}
880+
```
881+
882+
## Azure Container Storage Owner
883+
884+
Install Azure Container Storage, grant access to its storage resources, and configure Azure Elastic storage area network (SAN). Includes an ABAC condition to constrain role assignments.
885+
886+
> [!div class="mx-tableFixed"]
887+
> | Actions | Description |
888+
> | --- | --- |
889+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/elasticSans/* | |
890+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/locations/* | |
891+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/elasticSans/volumeGroups/* | |
892+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/elasticSans/volumeGroups/volumes/* | |
893+
> | [Microsoft.ElasticSan](../permissions/storage.md#microsoftelasticsan)/locations/asyncoperations/read | Polls the status of an asynchronous operation. |
894+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/write | Creates or updates extension resource. |
895+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |
896+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/delete | Deletes extension instance resource. |
897+
> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/operations/read | Gets Async Operation status. |
898+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
899+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
900+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
901+
> | [Microsoft.Management](../permissions/management-and-governance.md#microsoftmanagement)/managementGroups/read | List management groups for the authenticated user. |
902+
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
903+
> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
904+
> | **NotActions** | |
905+
> | *none* | |
906+
> | **DataActions** | |
907+
> | *none* | |
908+
> | **NotDataActions** | |
909+
> | *none* | |
910+
> | **Actions** | |
911+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
912+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
913+
> | **NotActions** | |
914+
> | *none* | |
915+
> | **DataActions** | |
916+
> | *none* | |
917+
> | **NotDataActions** | |
918+
> | *none* | |
919+
> | **Condition** | |
920+
> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) | Add or remove role assignments for the following roles:<br/>Azure Container Storage Operator |
921+
922+
```json
923+
{
924+
"assignableScopes": [
925+
"/"
926+
],
927+
"description": "Lets you install Azure Container Storage and grants access to its storage resources",
928+
"id": "/providers/Microsoft.Authorization/roleDefinitions/95de85bd-744d-4664-9dde-11430bc34793",
929+
"name": "95de85bd-744d-4664-9dde-11430bc34793",
930+
"permissions": [
931+
{
932+
"actions": [
933+
"Microsoft.ElasticSan/elasticSans/*",
934+
"Microsoft.ElasticSan/locations/*",
935+
"Microsoft.ElasticSan/elasticSans/volumeGroups/*",
936+
"Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
937+
"Microsoft.ElasticSan/locations/asyncoperations/read",
938+
"Microsoft.KubernetesConfiguration/extensions/write",
939+
"Microsoft.KubernetesConfiguration/extensions/read",
940+
"Microsoft.KubernetesConfiguration/extensions/delete",
941+
"Microsoft.KubernetesConfiguration/extensions/operations/read",
942+
"Microsoft.Authorization/*/read",
943+
"Microsoft.Resources/subscriptions/resourceGroups/read",
944+
"Microsoft.Resources/subscriptions/read",
945+
"Microsoft.Management/managementGroups/read",
946+
"Microsoft.Resources/deployments/*",
947+
"Microsoft.Support/*"
948+
],
949+
"notActions": [],
950+
"dataActions": [],
951+
"notDataActions": []
952+
},
953+
{
954+
"actions": [
955+
"Microsoft.Authorization/roleAssignments/write",
956+
"Microsoft.Authorization/roleAssignments/delete"
957+
],
958+
"notActions": [],
959+
"dataActions": [],
960+
"notDataActions": [],
961+
"conditionVersion": "2.0",
962+
"condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
963+
}
964+
],
965+
"roleName": "Azure Container Storage Owner",
966+
"roleType": "BuiltInRole",
967+
"type": "Microsoft.Authorization/roleDefinitions"
968+
}
969+
```
970+
730971
## Azure Kubernetes Fleet Manager Contributor Role
731972

732973
Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.

0 commit comments

Comments
 (0)