If you are asking about built-in roles, you need Monitoring Contributor at least
https://learn.microsoft.com/en-us/azure/azure-monitor/roles-permissions-security#built-in-monitoring-roles
In the meantime, you can create a custom role that will be granted to update alert instances only.