Yes, it is possible to create a custom role in Azure RBAC (Role-Based Access Control) with the ability to grant lesser roles to specific resources. This can help you delegate certain permissions without granting full administrative access.
- Identify the desired permissions: Determine the specific roles or permissions that you want to grant to the Service Principal. For example, you mentioned granting "Storage Container read" or "Eventhub reader" roles.
- Create a custom role definition: Use the Azure portal, Azure CLI, or Azure PowerShell to create a custom role definition that includes the desired permissions. You can specify the exact actions, resources, and scope of the role.
$roleName = "Custom Role"
$roleDescription = "Custom role with limited permissions"
$permissions = @{
"actions" = @("Microsoft.Storage/storageAccounts/blobServices/containers/read", "Microsoft.EventHub/namespaces/authorizationRules/listKeys/action")
"notActions" = @()
"dataActions" = @()
"notDataActions" = @()
}
New-AzRoleDefinition -Name $roleName -Description $roleDescription -Actions $permissions.actions -NotActions $permissions.notActions -DataActions $permissions.dataActions -NotDataActions $permissions.notDataActions
- Assign the custom role to the Service Principal: Once the custom role definition is created, it can be assigned to the Service Principal associated with your resource. You can do this using the Azure portal, Azure CLI, or Azure PowerShell.
$spObjectId = "<Service Principal Object ID>"
$roleName = "Custom Role"
New-AzRoleAssignment -ObjectId $spObjectId -RoleDefinitionName $roleName