Creating a Custom Role in Microsoft Azure

Create a Custom Role

1. In the Azure portal, open a subscription or resource group where you want the custom role to be assignable.

2. Open 'Access control (IAM)'. Click Add → Add custom role*. Name the role CloudAware Custom Policy.

3. Open the tab 'JSON'. Use the JSON template below. Fill your subscription id in the {subscription_id} field.

{
  "IsCustom": true,
  "Name": "CloudAware Collector Extended",
  "Description": "For collecting data about Blob Containers and VHDs we need to get access to the Storage Account keys as the default Role Reader does not provide API access to these keys.",
  "Actions": [
    "Microsoft.Compute/virtualMachines/extensions/write",
    "Microsoft.Storage/storageAccounts/listKeys/action"
  ],
  "notActions": [],
  "assignableScopes": [
    "/subscriptions/{subscription_id}"
  ]
}

Read more

Commonly used Azure built-in roles:

Read more

*In case a custom role already exists in your environment, its JSON body should look like the template below:

{
  "name": "{your-existing-Role-definition-id}",
  "permissions": [
    {
      "actions": [
        "Microsoft.Compute/virtualMachines/extensions/write",
        "Microsoft.Storage/storageAccounts/listKeys/action"
      ],
      "notActions": []
    }
  ],
  "AssignableScopes": [
    "/subscriptions/{subscription-id}",
     "/subscriptions/{subscription-id}",
    "/subscriptions/{subscription-id}"
  ],
  "RoleName": "{your-Role-name}",
  "RoleType": "CustomRole",
  "type": "Microsoft.Authorization/RoleDefinitions"
}

Replace {your-existing-Role-definition-id} with your role definition id. In the section "AssignableScopes" add the string "/subscriptions/{subscription-id}" with your {subscription-id}.

4. Assign the custom role to a user in case you are adding a Native application, or to the application in case you are adding a Web app/API. By performing this action, you confirm access to your virtual machines to be granted to the appropriate user for potential data modification.

Update an Existing Cloudaware Custom Policy

Cloudaware may regularly introduce new capabilities which require addition of new actions and permissions. In cases a Cloudaware custom role already exists, you can update this role without updating it for every subscription. If updating an existing Cloudaware Custom Policy Role is required, your Technical Account manager will provide you with instructions on how to perform this action.