Assigning a Custom Role to an Packer Application on Azure

Question

We currently have a Packer enterprise application that is running with the Contributor Role at the subscription level.

However, we feel that the application has too much scope. Instead we would like to give it Contributor level access for just one resource group.

Therefore, Packer would be able to create its temporary resources for creating images in just one resource group and would not need permissions for anything else in the subscription.

I created a custom role via JSON as follows: (I've changed to example subscription ID and resource names)

{
  "assignableScopes": [
    "/subscriptions/123456789/resourceGroups/packer"
  ],
  "description": "Custom role for packer app, with granular permssions for packer resource group",
  "id": "/subscriptions/123456789/providers/Microsoft.Authorization/roleDefinitions/123456-1234-1234-1234-12345678",
  "name": "123456-1234-1234-1234-12345678",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/Delete",
        "Microsoft.Authorization/*/Write",
        "Microsoft.Authorization/elevateAccess/Action",
        "Microsoft.Blueprint/blueprintAssignments/write",
        "Microsoft.Blueprint/blueprintAssignments/delete"
      ],
      "dataActions": [],
      "notActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "PackerRole",
  "roleType": "CustomRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

I then created the role using Azure CLI:

az role definition create --role-definition PackerRole.json --subscription 123456789

However, I do not know how to assign it to the Packer application. It can't be assigned and doesn't appear at the subscription scope -- presumably because the custom role only has a scope of 1 resource group.

I've tried going to Azure Active Directory --> App Registrations --> Packer, but there is nowhere here to assign my custom created role. The 'Roles and Administrators' tab gives me no clarity as none of our custom roles are here, and creating a new role only seems to allow Permission actions in the format of microsoft.directory/applications/

Viewing the Managed Application page for this app provides no answers either, only allowing for User and Group assignment.

I've scoured the documentation but haven't found anything relevant to this use case so far.

user_12247391 · Answer

You shouldn't need a custom role for this. The Contributor role is built-in and can be assigned to any scope. The reason your custom role can't be seen is that you're missing the "isCustom": true setting from the root of the object.

If you wish to assign contributor at the resource group level, you can use the Portal, PowerShell, Azure CLI, or even the REST APIs. This is known as a role assignment. Since you seem to be using the CLI, you can assign the role at the RG scope as follows:

Assuming your application is running using a service principal:

az role assignment create --assignee  --role Contributor --scope /subscriptions/123456789/resourceGroups/packer --assignee-principal-type ServicePrincipal

If you want to use the Portal, you can go to Resource Groups -> packer -> Access control (IAM) -> Role assignments -> Add

Assigning a Custom Role to an Packer Application on Azure

1 Answers