-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathaad.roles.json
145 lines (145 loc) · 6.67 KB
/
aad.roles.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
[
{
"Actions": [
"Microsoft.OperationalInsights/workspaces/write",
"Microsoft.Compute/availabilitySets/write",
"Microsoft.Compute/locations/operations/read",
"Microsoft.Compute/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Storage/operations/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Resources/deployments/read",
"Microsoft.Resources/deployments/write",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Authorization/policyAssignments/write",
"Microsoft.Authorization/policyDefinitions/write",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Authorization/roleDefinitions/write"
],
"AssignableScopes": [
"/subscriptions/${subscription-id}"
],
"Description": "Can manage infrastructure for workload based workload.",
"IsCustom": "true",
"Name": "SysOps",
"NotActions": []
},
{
"Actions": [
"Microsoft.Insights/diagnosticsettings/write",
"Microsoft.KeyVault/hsmPools/read",
"Microsoft.KeyVault/hsmPools/write",
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/write",
"Microsoft.KeyVault/vaults/secrets/read",
"Microsoft.KeyVault/vaults/secrets/write",
"Microsoft.KeyVault/vaults/accessPolicies/write",
"Microsoft.Compute/availabilitySets/write",
"Microsoft.Compute/locations/operations/read",
"Microsoft.Compute/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Network/loadBalancers/write",
"Microsoft.Network/locations/operations/read",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/routeTables/read",
"Microsoft.Network/routeTables/write",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Resources/deployments/read",
"Microsoft.Resources/deployments/write",
"Microsoft.Authorization/policyAssignments/write",
"Microsoft.Authorization/policyDefinitions/write",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Authorization/roleDefinitions/write"
],
"AssignableScopes": [
"/subscriptions/${subscription-id}"
],
"Description": "Can manage KeyVault resources for workload based workload.",
"IsCustom": "true",
"Name": "SecOps",
"NotActions": []
},
{
"Actions": [
"Microsoft.Network/applicationSecurityGroups/write",
"Microsoft.Network/networkSecurityGroups/write",
"Microsoft.Network/ddosProtectionPlans/write",
"Microsoft.Network/locations/operations/read",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/routeTables/read",
"Microsoft.Network/routeTables/write",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Network/azureFirewalls/read",
"Microsoft.Network/azureFirewalls/write",
"Microsoft.Network/applicationGateways/read",
"Microsoft.Network/applicationGateways/write",
"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/write",
"Microsoft.Compute/availabilitySets/write",
"Microsoft.Compute/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Storage/operations/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Resources/deployments/read",
"Microsoft.Resources/deployments/write",
"Microsoft.Authorization/policyAssignments/write",
"Microsoft.Authorization/policyDefinitions/write",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Authorization/roleDefinitions/write"
],
"AssignableScopes": [
"/subscriptions/${subscription-id}"
],
"Description": "Can manage infrastructure for workload based workload.",
"IsCustom": "true",
"Name": "NetOps",
"NotActions": []
},
{
"Actions": [
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/write",
"Microsoft.Compute/availabilitySets/write",
"Microsoft.Compute/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Storage/operations/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Resources/deployments/read",
"Microsoft.Resources/deployments/write",
"Microsoft.Authorization/policyAssignments/write",
"Microsoft.Authorization/policyDefinitions/write",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Authorization/roleDefinitions/write"
],
"AssignableScopes": [
"/subscriptions/${subscription-id}"
],
"Description": "Can manage compute and storage resources for workload based workload.",
"IsCustom": "true",
"Name": "DevOps",
"NotActions": []
}
]