Azure / Azure/azure-rest-api-specs
Include required RBAC Action(s) for each operation in documentation
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
See [Azure PowerShell Issue 6843](https://github.com/Azure/azure-powershell/issues/6843)
There are many scenarios where to perform a given operation, there isn't a least-privileged built-in RBAC role that grants the required permissions to perform the operation. Simple examples include restarting a Web App, VM, etc. Other scenarios (which are more complex beyond the rest apis themselves) include granting SQL DB Contributor on a SQL DB doesn't actually allow you to run an ARM deployment as that also requires Microsoft.Resources/deployments/* on the instance's resource group.
Please consider documenting the required RBAC actions per operation so that it is easier to discover and determine when it is appropriate for creating a custom RBAC role.
Contributor guide
Research direction
No file, test, or entry point is identified. Start by reviewing the Azure REST API specifications and the linked Azure PowerShell issue to define the documentation scope; done means required RBAC actions are documented for each operation and the guidance covers custom-role decisions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authorization, cloud, documentation
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100