azureblog.co.uk
← cd ~/roles
// roles/azure · containers

AcrImageSignerAzure built-in role

Planned DEPRECATION on March 31, 2028. Grant the signing permission for content trust. As content trust is being deprecated and will be completely removed on March 31, 2028, this role will also be removed. Refer to https://aka.ms/acr/dctdeprecation for details and transition guidance.

Role ID6cef56e8-d556-48e5-a04f-b8e64114680f
CategoryContainers
Actions1
Data actions1

Before you assign it

  • It reaches the data, not just the resource. It has 1 data action, such as reading blobs, secrets or messages.

What it can do

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/sign/writePush/Pull content trust metadata for a container registry.

Data actions

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/trustedCollections/writeAllows push or publish of trusted collections of container registry content. This is similar to Microsoft.ContainerRegistry/registries/sign/write action except that this is a data action

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "AcrImageSigner" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "AcrImageSigner" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '6cef56e8-d556-48e5-a04f-b8e64114680f')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "6cef56e8-d556-48e5-a04f-b8e64114680f"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources