Creating a custom RBAC role
RBAC is a general term used for restricting access to users, based on a role. It works on the Just Enough Access (JEA) concept where a specific user/group will be provided minimum access to perform their specific job on a specific resource. Custom roles can only be created and updated by a user who has the following role assigned: Microsoft.Authorization/roleDefinitions/write permissions.
When it comes to RBAC, it is very important to understand how and where it is applied. Azure RBAC can be applied to the following security principals:
- User
- Group
- Service principal
- Managed identity
Now that we know what security principals support RBAC, the next step is to have a look at role definitions. A role definition is a collection of permissions that can be applied to security principals; however, in Azure, this is referred to as a role. A role is what determines what operations are allowed – for example, read access, write access...