Azure / Azure/azure-rest-api-specs

Include required RBAC Action(s) for each operation in documentation

Open
#4,468 0 comments 3 reactions 0 assignees View on GitHub
ARM - RBAC customer-reported needs-team-attention Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

See [Azure PowerShell Issue 6843](https://github.com/Azure/azure-powershell/issues/6843)

There are many scenarios where to perform a given operation, there isn't a least-privileged built-in RBAC role that grants the required permissions to perform the operation. Simple examples include restarting a Web App, VM, etc. Other scenarios (which are more complex beyond the rest apis themselves) include granting SQL DB Contributor on a SQL DB doesn't actually allow you to run an ARM deployment as that also requires Microsoft.Resources/deployments/* on the instance's resource group.

Please consider documenting the required RBAC actions per operation so that it is easier to discover and determine when it is appropriate for creating a custom RBAC role.

Contributor guide

Open the contributing guide

Research direction

No file, test, or entry point is identified. Start by reviewing the Azure REST API specifications and the linked Azure PowerShell issue to define the documentation scope; done means required RBAC actions are documented for each operation and the guidance covers custom-role decisions.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud, documentation
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.