azureblog.co.uk
← cd ~/roles
// roles/azure · containers

Service Fabric Cluster ContributorAzure built-in role

Manage your Service Fabric Cluster resources. Includes clusters, application types, application type versions, applications, and services. You will need additional permissions to deploy and manage the cluster's underlying resources such as virtual machine scale sets, storage accounts, networks, etc.

Role IDb6efc156-f0da-4e90-a50a-8c000140b017
CategoryContainers
Actions10
Data actions0

What it can do

PermissionWhat it allows
Microsoft.ServiceFabric/clusters/*Every operation under Microsoft.ServiceFabric/clusters
Microsoft.ServiceFabric/operations/readRead any Available Operations
Microsoft.ServiceFabric/locations/clusterVersions/readRead any Cluster Version
Microsoft.ServiceFabric/locations/environments/clusterVersions/readRead any Cluster Version for a specific environment
Microsoft.ServiceFabric/locations/operationresults/readRead any Operation Results
Microsoft.ServiceFabric/locations/operations/readRead any Operations by location
Microsoft.Authorization/*/readAny read operation on anything under Microsoft.Authorization
Microsoft.Insights/alertRules/*Every operation under Microsoft.Insights/alertRules
Microsoft.Resources/deployments/*Every operation under Microsoft.Resources/deployments
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Service Fabric Cluster Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Service Fabric Cluster Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'b6efc156-f0da-4e90-a50a-8c000140b017')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b6efc156-f0da-4e90-a50a-8c000140b017')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "b6efc156-f0da-4e90-a50a-8c000140b017"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

Find the smallest role for a task →

Sources