// roles/azure · containers

Azure Red Hat OpenShift Cloud Controller ManagerAzure built-in role

Manage and update the cloud controller manager deployed on top of OpenShift.

Role ID	`a1f96423-95ce-4224-ab27-4e3dc72facd4`
Category	Containers
Actions	28
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Network/loadBalancers/backendAddressPools/join/action`	Joins a load balancer backend address pool. Not Alertable.
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/loadBalancers/write`	Creates a load balancer or updates an existing load balancer
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkSecurityGroups/read`	Gets a network security group definition
`Microsoft.Network/networkSecurityGroups/write`	Creates a network security group or updates an existing network security group
`Microsoft.Network/publicIPAddresses/join/action`	Joins a public IP address. Not Alertable.
`Microsoft.Network/publicIPAddresses/read`	Gets a public IP address definition.
`Microsoft.Network/publicIPAddresses/write`	Creates a public IP address or updates an existing public IP address.
`Microsoft.Network/publicIPAddresses/delete`	Deletes a public IP address.
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/loadBalancers/inboundNatRules/join/action`	Joins a load balancer inbound nat rule. Not Alertable.
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/publicIPPrefixes/join/action`	Joins a PublicIPPrefix. Not alertable.
`Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action`	Joins a Security Rule to Application Security Groups. Not alertable.
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/privatelinkservices/write`	Creates a new private link service, or updates an existing private link service.
`Microsoft.Network/privatelinkservices/read`	Gets an private link service resource.
`Microsoft.Network/privatelinkservices/delete`	Deletes an private link service resource.
`Microsoft.Network/loadBalancers/loadBalancingRules/read`	Gets a load balancer load balancing rule definition
`Microsoft.Network/serviceEndpointPolicies/join/action`	Joins a Service Endpoint Policy. Not alertable.
`Microsoft.Network/natGateways/join/action`	Joins a NAT Gateway
`Microsoft.Network/networkIntentPolicies/join/action`	Joins a Network Intent Policy. Not alertable.
`Microsoft.Network/routeTables/join/action`	Joins a route table. Not Alertable.
`Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action`	Action permission for associate resources to Ipam Pool

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Red Hat OpenShift Cloud Controller Manager" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Red Hat OpenShift Cloud Controller Manager" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'a1f96423-95ce-4224-ab27-4e3dc72facd4')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a1f96423-95ce-4224-ab27-4e3dc72facd4')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "a1f96423-95ce-4224-ab27-4e3dc72facd4"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles