azure-rbac

Files (1)

• SKILL.md

SKILL.md (first lines)

# Azure RBAC

Grant the minimum required access at management group, subscription, resource group, or resource scope.
Build scalable, auditable identity infrastructure using groups, managed identities, and Privileged Identity Management.

## Use This Skill When

- The user needs role assignment design or access error diagnosis
- The user wants to secure team access or workload permissions
- The user needs compliance-ready access governance (audit trail, reviews)
- The user wants to migrate from per-user to group-based RBAC

## Context: RBAC Maturity

**Immature**: Ad hoc assignments, direct user permissions, no audit trail  
**Developing**: Some group-based access, manual reviews, audit logs exist  
**Managed**: Group-based RBAC, scoped assignments, automated access reviews, PIM for elevation → **Target**  
**Optimized**: Zero Trust with managed identities, ephemeral access, real-time risk-based access decisions

## Required Inputs

- **Principals**: Users, groups, service principals, managed identities
- **Required actions**: Specific operations (create, delete, read, write)
- **Resource scope**: Subscription, resource group, or individual resource
- **Compliance needs**: Audit trail required? Access reviews? Time-bound access?
- **Escalation model**: Who approves elevated access? How long is it valid?

## Decision Tree

```
Is this human access (person) or workload identity (application)?
├─ Human:
│  ├─ Is this just viewing resources? → Reader role
│  ├─ Is this deploying/configuring? → Contributor role (at resource group scope)
│  ├─ Is this infrastructure admin work? → PIM-eligible Owner (with approval)
│  └─ Is this on a single resource? → Role-scoped to that resource
└─ Workload:
   ├─ Is this a new app? → Create user-assigned managed identity, assign narrow role
   ├─ Needs secret access? → Key Vault Secrets User role
   ├─ Needs storage access? → Storage Blob Data Contributor (scoped)
   └─ Needs database? → SQL DB Contributor (scoped)

Should this access be permanent or temporary?
├─ Permanent → Standard role assignment (group-based for humans)
└─ Temporary/Elevated → PIM-eligible role (approval workflow, 4-hour max)

How many users need this access?
├─ 1-2 people → Consider if per-user assignment is necessary
├─ 3+ people → MUST use security group assignment
└─ 10+ people → Automate group membership from identity provider
```

## Workflow

### Phase 1: Map Workload to Required Roles

1. **Identify actions needed**:
   ```
   Workload: Web App
   ├─ Needs: Read secrets from Key Vault
   ├─ Needs: Write logs to Storage Account
   ├─ Needs: Query SQL Database
   ├─ Needs: Read configuration from App Configuration
   └─ Needs: Call downstream API (no Azure role, only app auth)
   ```

2. **Match to built-in roles** (prefer over custom):
   ```
   - Key Vault Secrets User (for secret read)
   - Storage Blob Data Contributor (for write to blob)
   - SQL DB Contributor (for database access)
   - App Configuration Data Reader (for config)
   ```

3. **Prefer built-in roles** unless none match exactly:
   ```
   ✓ Use: "Key Vault Secrets User" (specific, audited)
   ✓ Use: "Storage Blob Data Contributor" (Microsoft-maintained)
   ✗ Avoid: Custom role with Microsoft.Storage/*
   ✗ Avoid: Contributor role (too broad)
   ```

### Phase 2: Human Access (Groups & PIM)

1. **Create security groups** for role assignment:
   ```bash
   # Azure AD group for developers
   az ad group create --display-name "contoso-app-developers" --mail-nickname "app-devs"
   
   # Add users to group
   az ad group member add --group app-devs --member-id $USER_ID
   ```

2. **Assign group to role at correct scope**:
   ```bash
   # Resource group scope (can deploy resources in group)
   az role assignment create \
     --role "Contributor" \
     --assignee-object-id $GROUP_ID \
     --scope "/subscriptions/$SUBID/resourceGroups/$RG"
   
   # Single resource scope (can configure only this resource)
   az role assignment create \
     --role "Key Vault Secrets User" \
     --assignee-object-id $GROUP_ID \
     --scope "/subscriptions/$SUBID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV"
   ```

3. **Use PIM for elevated access** (Owner, Admin):
   ```bash
   # Make group eligible for Owner role (requires approval to activate)
   az rest --method post --uri "https://graph.microsoft.com/v1.0/privilegedIdentityManagement/roleAssignments" \
     --body '{"roleDefinitionId":"'$OWNER_ROLE_ID'","principalId":"'$GROUP_ID'","resourceId":"'$SCOPE'","type":"eligible"}'
   ```

4. **Set up access reviews** (quarterly):
   ```bash
   # Schedule review of all role assignments
   # Portal: Azure AD > Identity Governance > Access Reviews

From manu14357/zskills, MIT.

More from manu14357/zskills