...
Keep in mind that you need permissions to create custom Roles, such as to have Owner or User Access Administrator permissions to create custom roles.
1. In the Azure portal, open a subscription or a resource group where you want the custom role is to be assignableassigned to.
2. Open 'Access control (IAM)'. Click Add → Add custom role*. Name the role CloudAware Custom Policy.
...
3.
a) 'Start from scratch'. Open the tab 'the tab Permissions → Add permissions. Copy and paste Microsoft.Storage/storageAccounts/listKeys/action in the Search for a permission box to select Microsoft Storage. Check the box near the permission. Click Add.
...
| Tip |
|---|
The permission If you are planning to install Breeze Agent, the permission |
b) 'Start from JSON'. Use the JSON template below. Fill your subscription id in the {subscription_id} field.
| Code Block |
|---|
{
"IsCustom": true,
"Name": "CloudAware Collector Extended",
"Description": "For collecting data about Blob Containers and VHDs we need to get access to the Storage Account keys as the default Rolerole Reader does not provide API access to these keys.",
"Actions": [
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Storage/storageAccounts/listKeys/action"
],
"notActions": [],
"assignableScopes": [
"/subscriptions/{subscription_id}"
]
} |
| Tip |
|---|
The permission If you are planning to install Breeze Agent, the permission |
Commonly used Azure built-in roles:
Built-in Role | ID |
|---|---|
Reader |
|
Contributor |
|
Virtual Machine Contributor |
|
Virtual Network Contributor |
|
Storage Account Contributor |
|
Web Plan Contributor |
|
SQL server Contributor |
|
SQL DB Contributor |
|
*c) 'Clone a role'.
In case a custom role already exists in your environment, its JSON body should look like the template below:
...
Cloudaware may regularly introduce new capabilities which require addition of new actions and permissions. In cases a Cloudaware custom role already exists, you can update this role without updating it for every subscription. If updating an existing Cloudaware Custom Policy Role role is required, your Technical Account manager will provide you with instructions on how to perform this action.
Custom role creation in Azure Portal is an asynchronous operation. This means that a time lag may take place between the creation of a Role role and time when this Role role becomes available.