azureblog.co.uk
← cd ~/roles
// roles/azure · containers

Container Registry Credential Set ReaderAzure built-in role

Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules.

Role ID29093635-9924-4f2c-913b-650a12949526
CategoryContainers
Actions1
Data actions0

What it can do

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/credentialSets/readGets the properties of the specified credential set or lists all the credential sets for the specified container registry

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Credential Set Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Credential Set Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '29093635-9924-4f2c-913b-650a12949526')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '29093635-9924-4f2c-913b-650a12949526')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "29093635-9924-4f2c-913b-650a12949526"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources