azureblog.co.uk
← cd ~/roles
// roles/azure · containers

Container Registry Data Importer and Data ReaderAzure built-in role

Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules.

Role ID577a9874-89fd-4f24-9dbd-b5034d0ad23a
CategoryContainers
Actions3
Data actions3

Before you assign it

  • It reaches the data, not just the resource. It has 3 data actions, such as reading blobs, secrets or messages.

What it can do

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/importImage/actionImport Image to container registry with the specified parameters.
Microsoft.ContainerRegistry/registries/readGets the properties of the specified container registry or lists all the container registries under the specified resource group or subscription.
Microsoft.ContainerRegistry/registries/pull/readPull or Get images from a container registry.

Data actions

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/repositories/content/readPull or Get images from a container registry.
Microsoft.ContainerRegistry/registries/repositories/metadata/readGets the metadata of a specific repository for a container registry
Microsoft.ContainerRegistry/registries/catalog/readList repositories in a container registry.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Data Importer and Data Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Data Importer and Data Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '577a9874-89fd-4f24-9dbd-b5034d0ad23a')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '577a9874-89fd-4f24-9dbd-b5034d0ad23a')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "577a9874-89fd-4f24-9dbd-b5034d0ad23a"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources