azureblog.co.uk
← cd ~/roles
// roles/azure · containers

Container Registry Credential Set AdministratorAzure built-in role

Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules.

Role IDf094fb07-0703-4400-ad6a-e16dd8000e14
CategoryContainers
Actions4
Data actions0

What it can do

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/credentialSets/readGets the properties of the specified credential set or lists all the credential sets for the specified container registry
Microsoft.ContainerRegistry/registries/credentialSets/writeCreates or updates a credential set for a container registry with the specified parameters
Microsoft.ContainerRegistry/registries/credentialSets/deleteDeletes a credential set from a container registry
Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/readGets a credential set async operation status

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Credential Set Administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Credential Set Administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'f094fb07-0703-4400-ad6a-e16dd8000e14')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f094fb07-0703-4400-ad6a-e16dd8000e14')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "f094fb07-0703-4400-ad6a-e16dd8000e14"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources