azureblog.co.uk
← cd ~/roles
// roles/azure · containers

Container Registry Configuration Reader and Data Access Configuration ReaderAzure built-in role

Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.

Role ID69b07be0-09bf-439a-b9a6-e73de851bd59
CategoryContainers
Actions33
Data actions0

What it can do

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/operationStatuses/readGets a registry async operation status
Microsoft.ContainerRegistry/registries/readGets the properties of the specified container registry or lists all the container registries under the specified resource group or subscription.
Microsoft.ContainerRegistry/registries/privateEndpointConnections/readGets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry
Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/readGet Private Endpoint Connection Async Operation Status
Microsoft.ContainerRegistry/registries/listCredentials/actionLists the login credentials for the specified container registry.
Microsoft.ContainerRegistry/registries/tokens/readGets the properties of the specified token or lists all the tokens for the specified container registry.
Microsoft.ContainerRegistry/registries/tokens/operationStatuses/readGets a token async operation status.
Microsoft.ContainerRegistry/registries/scopeMaps/readGets the properties of the specified scope map or lists all the scope maps for the specified container registry.
Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/readGets a scope map async operation status.
Microsoft.ContainerRegistry/registries/webhooks/readGets the properties of the specified webhook or lists all the webhooks for the specified container registry.
Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/actionGets the configuration of service URI and custom headers for the webhook.
Microsoft.ContainerRegistry/registries/webhooks/listEvents/actionLists recent events for the specified webhook.
Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/readGets a webhook async operation status
Microsoft.ContainerRegistry/registries/replications/readGets the properties of the specified replication or lists all the replications for the specified container registry.
Microsoft.ContainerRegistry/registries/replications/operationStatuses/readGets a replication async operation status
Microsoft.ContainerRegistry/registries/connectedRegistries/readGets the properties of the specified connected registry or lists all the connected registries for the specified container registry.
Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/readGets the diagnostic setting for the resource
Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/writeCreates or updates the diagnostic setting for the resource
Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/readGets the available logs for Microsoft ContainerRegistry
Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/readGets the available metrics for Microsoft ContainerRegistry
Microsoft.Insights/AlertRules/WriteCreate or update a classic metric alert
Microsoft.Insights/AlertRules/DeleteDelete a classic metric alert
Microsoft.Insights/AlertRules/ReadRead a classic metric alert
Microsoft.Insights/AlertRules/Activated/ActionClassic metric alert activated
Microsoft.Insights/AlertRules/Resolved/ActionClassic metric alert resolved
Microsoft.Insights/AlertRules/Throttled/ActionClassic metric alert rule throttled
Microsoft.Insights/AlertRules/Incidents/ReadRead a classic metric alert incident
Microsoft.Resources/deployments/readGets or lists deployments.
Microsoft.Resources/deployments/*/readAny read operation on anything under Microsoft.Resources/deployments
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Network/privateEndpoints/privateLinkServiceProxies/readGets a private link service proxy resource.
Microsoft.Network/virtualNetworks/readGet the virtual network definition
Microsoft.Network/virtualNetworks/subnets/readGets a virtual network subnet definition

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Configuration Reader and Data Access Configuration Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Configuration Reader and Data Access Configuration Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '69b07be0-09bf-439a-b9a6-e73de851bd59')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69b07be0-09bf-439a-b9a6-e73de851bd59')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "69b07be0-09bf-439a-b9a6-e73de851bd59"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources