// roles/azure · containers

Azure Red Hat OpenShift Image Registry OperatorAzure built-in role

Enables permissions for the operator to manage a singleton instance of the OpenShift image registry. It manages all configuration of the registry, including creating storage.

Role ID	`8b32b316-c2f5-4ddf-b05b-83dacd2d08b5`
Category	Containers
Actions	25
Data actions	5

Before you assign it

It reaches the data, not just the resource. It has 5 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.Storage/storageAccounts/blobServices/read`	List blob services
`Microsoft.Storage/storageAccounts/blobServices/containers/read`	Returns a container
`Microsoft.Storage/storageAccounts/blobServices/containers/write`	Returns the result of patch blob container
`Microsoft.Storage/storageAccounts/blobServices/containers/delete`	Returns the result of deleting a container
`Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`	Returns a user delegation key for the blob service
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Storage/storageAccounts/write`	Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account.
`Microsoft.Storage/storageAccounts/delete`	Deletes an existing storage account.
`Microsoft.Storage/storageAccounts/listKeys/action`	Returns the access keys for the specified storage account.
`Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action`	Approve Private Endpoint Connections
`Microsoft.Resources/tags/write`	Updates the tags on a resource by replacing or merging existing tags with a new set of tags, or removing existing tags.
`Microsoft.Network/privateEndpoints/write`	Creates a new private endpoint, or updates an existing private endpoint.
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write`	Puts a Private DNS Zone Group
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read`	Gets a Private DNS Zone Group
`Microsoft.Network/privateDnsZones/read`	Get the Private DNS zone properties, in JSON format. Note that this command does not retrieve the virtual networks to which the Private DNS zone is linked or the record sets contained within the zone.
`Microsoft.Network/privateDnsZones/write`	Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone.
`Microsoft.Network/privateDnsZones/join/action`	Joins a Private DNS Zone
`Microsoft.Network/privateDnsZones/A/write`	Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set.
`Microsoft.Network/privateDnsZones/virtualNetworkLinks/write`	Create or update a Private DNS zone link to virtual network.
`Microsoft.Network/privateDnsZones/virtualNetworkLinks/read`	Get the Private DNS zone link to virtual network properties, in JSON format.
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/join/action`	Joins a virtual network. Not Alertable.

Data actions

Permission	What it allows
`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`	Returns the result of deleting a blob
`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`	Returns the result of writing a blob
`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`	Returns a blob or a list of blobs
`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action`	Returns the result of adding blob content
`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action`	Moves the blob from one path to another

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Red Hat OpenShift Image Registry Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Red Hat OpenShift Image Registry Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '8b32b316-c2f5-4ddf-b05b-83dacd2d08b5')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8b32b316-c2f5-4ddf-b05b-83dacd2d08b5')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "8b32b316-c2f5-4ddf-b05b-83dacd2d08b5"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles