azureblog.co.uk
← cd ~/roles
// roles/azure · containers

Container Registry Transfer Pipeline ContributorAzure built-in role

Provides the ability to transfer, import, and export artifacts through configuring registry transfer pipelines that involve intermediary storage accounts and key vaults. Does not provide permissions to push or pull images. Does not provide permissions to create, manage, or list storage accounts or key vaults. Does not provide permissions to perform role assignments.

Role IDbf94e731-3a51-4a7c-8c54-a1ab9971dfc1
CategoryContainers
Actions10
Data actions0

What it can do

PermissionWhat it allows
Microsoft.ContainerRegistry/registries/exportPipelines/readGets the properties of the specified export pipeline or lists all the export pipelines for the specified container registry.
Microsoft.ContainerRegistry/registries/exportPipelines/writeCreates or updates an export pipeline for a container registry with the specified parameters.
Microsoft.ContainerRegistry/registries/exportPipelines/deleteDeletes an export pipeline from a container registry.
Microsoft.ContainerRegistry/registries/importPipelines/readGets the properties of the specified import pipeline or lists all the import pipelines for the specified container registry.
Microsoft.ContainerRegistry/registries/importPipelines/writeCreates or updates an import pipeline for a container registry with the specified parameters.
Microsoft.ContainerRegistry/registries/importPipelines/deleteDeletes an import pipeline from a container registry.
Microsoft.ContainerRegistry/registries/pipelineRuns/readGets the properties of the specified pipeline run or lists all the pipeline runs for the specified container registry.
Microsoft.ContainerRegistry/registries/pipelineRuns/writeCreates or updates a pipeline run for a container registry with the specified parameters.
Microsoft.ContainerRegistry/registries/pipelineRuns/deleteDeletes a pipeline run from a container registry.
Microsoft.ContainerRegistry/registries/pipelineRuns/operationStatuses/readGets a pipeline run async operation status.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Transfer Pipeline Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Transfer Pipeline Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'bf94e731-3a51-4a7c-8c54-a1ab9971dfc1')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'bf94e731-3a51-4a7c-8c54-a1ab9971dfc1')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "bf94e731-3a51-4a7c-8c54-a1ab9971dfc1"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources