// roles/azure · containers

Azure Red Hat OpenShift Machine API OperatorAzure built-in role

Manage the lifecycle of specific-purpose custom resource definitions (CRD), controllers, and Azure RBAC objects that extend the Kubernetes API to declares the desired state of machines in a cluster.

Role ID	`0358943c-7e01-48ba-8889-02cc51d78637`
Category	Containers
Actions	35
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Compute/availabilitySets/delete`	Deletes the availability set
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/availabilitySets/write`	Creates a new availability set or updates an existing one
`Microsoft.Compute/diskEncryptionSets/read`	Get the properties of a disk encryption set
`Microsoft.Compute/disks/delete`	Deletes the Disk
`Microsoft.Compute/galleries/images/versions/read`	Gets the properties of Gallery Image Version
`Microsoft.Compute/skus/read`	Gets the list of Microsoft.Compute SKUs available for your Subscription
`Microsoft.Compute/virtualMachines/delete`	Deletes the virtual machine
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/write`	Creates a new virtual machine or updates an existing virtual machine
`Microsoft.Compute/capacityReservationGroups/deploy/action`	Deploy a new VM/VMSS using Capacity Reservation Group
`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`	RBAC action for assigning an existing user assigned identity to a resource
`Microsoft.Network/applicationSecurityGroups/read`	Gets an Application Security Group ID.
`Microsoft.Network/loadBalancers/backendAddressPools/join/action`	Joins a load balancer backend address pool. Not Alertable.
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/loadBalancers/write`	Creates a load balancer or updates an existing load balancer
`Microsoft.Network/networkInterfaces/delete`	Deletes a network interface
`Microsoft.Network/networkInterfaces/join/action`	Joins a Virtual Machine to a network interface. Not Alertable.
`Microsoft.Network/networkInterfaces/loadBalancers/read`	Gets all the load balancers that the network interface is part of
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkSecurityGroups/read`	Gets a network security group definition
`Microsoft.Network/networkSecurityGroups/write`	Creates a network security group or updates an existing network security group
`Microsoft.Network/publicIPAddresses/delete`	Deletes a public IP address.
`Microsoft.Network/publicIPAddresses/join/action`	Joins a public IP address. Not Alertable.
`Microsoft.Network/publicIPAddresses/read`	Gets a public IP address definition.
`Microsoft.Network/publicIPAddresses/write`	Creates a public IP address or updates an existing public IP address.
`Microsoft.Network/routeTables/read`	Gets a route table definition
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action`	Joins a Security Rule to Application Security Groups. Not alertable.
`Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action`	Joins a Load Balancer Frontend IP Configuration. Not alertable.
`Microsoft.Network/loadBalancers/inboundNATRules/join/action`	Joins a load balancer inbound nat rule. Not Alertable.
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Red Hat OpenShift Machine API Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Red Hat OpenShift Machine API Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '0358943c-7e01-48ba-8889-02cc51d78637')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0358943c-7e01-48ba-8889-02cc51d78637')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "0358943c-7e01-48ba-8889-02cc51d78637"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles