Skip to content

Commit 7e496a9

Browse files
paolosalvatoriremotesynth
paolosalvatori
and
remotesynth
authored
Azure Docs: Azure Role Assignment (#590)
Co-authored-by: Brian Rinaldi <brian.rinaldi@gmail.com>
1 parent 5b6c590 commit 7e496a9

1 file changed

Lines changed: 344 additions & 0 deletions

File tree

‎src/content/docs/azure/services/role-assignment.mdx‎

Lines changed: 344 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,344 @@
1+
---
2+
title: "Role Assignment"
3+
description: Get started with Azure Role Assignments on LocalStack
4+
template: doc
5+
---
6+
7+
import AzureFeatureCoverage from "../../../../components/feature-coverage/AzureFeatureCoverage";
8+
9+
## Introduction
10+
11+
Azure Role Assignments grant an identity (user, group, or service principal) the permissions defined by a role definition at a specific scope.
12+
Together with Role Definitions, Role Assignments form the foundation of Azure RBAC.
13+
They are commonly used to grant managed identities access to storage accounts, key vaults, and other Azure resources in infrastructure automation scenarios. For more information, see [Assign Azure roles using the Azure CLI](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli).
14+
15+
LocalStack for Azure provides a local environment for building and testing applications that make use of Azure Role Assignments.
16+
The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of Role Assignments' integration with LocalStack.
17+
18+
## Getting started
19+
20+
This guide walks you through assigning a built-in role to a managed identity, listing assignments, and removing the assignment.
21+
22+
Launch LocalStack using your preferred method. For more information, see [Introduction to LocalStack for Azure](/azure/getting-started/). Once the container is running, enable Azure CLI interception by running:
23+
24+
```bash
25+
azlocal start-interception
26+
```
27+
28+
This command points the `az` CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API.
29+
To revert this configuration, run:
30+
31+
```bash
32+
azlocal stop-interception
33+
```
34+
35+
This reconfigures the `az` CLI to send commands to the official Azure management REST API.
36+
37+
### Create a resource group
38+
39+
Create a resource group to hold all resources created in this guide:
40+
41+
```bash
42+
az group create --name rg-rbac-demo --location westeurope
43+
```
44+
45+
```bash title="Output"
46+
{
47+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo",
48+
"location": "westeurope",
49+
"managedBy": null,
50+
"name": "rg-rbac-demo",
51+
"properties": {
52+
"provisioningState": "Succeeded"
53+
},
54+
"tags": null,
55+
"type": "Microsoft.Resources/resourceGroups"
56+
}
57+
```
58+
59+
### Create a user-assigned managed identity
60+
61+
Create a user-assigned managed identity to use as the role assignee:
62+
63+
```bash
64+
az identity create \
65+
--name my-identity \
66+
--resource-group rg-rbac-demo
67+
```
68+
69+
```bash title="Output"
70+
{
71+
"clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
72+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity",
73+
"isolationScope": "None",
74+
"location": "westeurope",
75+
"name": "my-identity",
76+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
77+
"resourceGroup": "rg-rbac-demo",
78+
"systemData": null,
79+
"tags": {},
80+
"tenantId": "00000000-0000-0000-0000-000000000000",
81+
"type": "Microsoft.ManagedIdentity/userAssignedIdentities"
82+
}
83+
```
84+
85+
Capture the identity's principal ID:
86+
87+
```bash
88+
PRINCIPAL_ID=$(az identity show \
89+
--name my-identity \
90+
--resource-group rg-rbac-demo \
91+
--query principalId \
92+
--output tsv)
93+
```
94+
95+
### Assign a built-in role
96+
97+
Assign the `Contributor` role to the identity at the resource group scope:
98+
99+
```bash
100+
SUBSCRIPTION_ID=$(az account show --query id --output tsv)
101+
az role assignment create \
102+
--assignee "$PRINCIPAL_ID" \
103+
--role Contributor \
104+
--scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/rg-rbac-demo"
105+
```
106+
107+
```bash title="Output"
108+
{
109+
"condition": null,
110+
"conditionVersion": null,
111+
"createdBy": null,
112+
"createdOn": null,
113+
"delegatedManagedIdentityResourceId": null,
114+
"description": null,
115+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
116+
"name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
117+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
118+
"principalType": "ServicePrincipal",
119+
"roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
120+
"scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo",
121+
"type": "Microsoft.Authorization/roleAssignments",
122+
"updatedBy": null,
123+
"updatedOn": null
124+
}
125+
```
126+
127+
### List role assignments
128+
129+
List all role assignments scoped to the resource group:
130+
131+
```bash
132+
az role assignment list \
133+
--scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/rg-rbac-demo"
134+
```
135+
136+
```bash title="Output"
137+
[
138+
{
139+
"condition": null,
140+
"conditionVersion": null,
141+
"createdBy": null,
142+
"createdOn": null,
143+
"delegatedManagedIdentityResourceId": null,
144+
"description": null,
145+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
146+
"name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
147+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
148+
"principalName": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
149+
"principalType": "ServicePrincipal",
150+
"roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
151+
"roleDefinitionName": "Contributor",
152+
"scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo",
153+
"type": "Microsoft.Authorization/roleAssignments",
154+
"updatedBy": null,
155+
"updatedOn": null
156+
}
157+
]
158+
```
159+
160+
### Filter by assignee
161+
162+
Filter the role assignments to show only assignments for the managed identity's principal ID:
163+
164+
```bash
165+
az role assignment list \
166+
--assignee "$PRINCIPAL_ID" \
167+
--all
168+
```
169+
170+
```bash title="Output"
171+
[
172+
{
173+
"condition": null,
174+
"conditionVersion": null,
175+
"createdBy": null,
176+
"createdOn": null,
177+
"delegatedManagedIdentityResourceId": null,
178+
"description": null,
179+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
180+
"name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
181+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
182+
"principalName": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
183+
"principalType": "ServicePrincipal",
184+
"roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
185+
"roleDefinitionName": "Contributor",
186+
"scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo",
187+
"type": "Microsoft.Authorization/roleAssignments",
188+
"updatedBy": null,
189+
"updatedOn": null
190+
}
191+
]
192+
```
193+
194+
### List all role assignments for the subscription
195+
196+
List every role assignment across the entire subscription:
197+
198+
```bash
199+
az role assignment list --all
200+
```
201+
202+
```bash title="Output"
203+
[
204+
{
205+
"condition": null,
206+
"conditionVersion": null,
207+
"createdBy": null,
208+
"createdOn": null,
209+
"delegatedManagedIdentityResourceId": null,
210+
"description": null,
211+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
212+
"name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
213+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
214+
"principalName": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
215+
"principalType": "ServicePrincipal",
216+
"roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
217+
"roleDefinitionName": "Contributor",
218+
"scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo",
219+
"type": "Microsoft.Authorization/roleAssignments",
220+
"updatedBy": null,
221+
"updatedOn": null
222+
}
223+
]
224+
```
225+
226+
### Assign a Storage Blob Data Owner role on a storage account
227+
228+
Create a storage account and assign the `Storage Blob Data Owner` role to the managed identity at the storage account scope.
229+
This is a common pattern in infrastructure automation where a function app or container needs full access to a specific storage account.
230+
231+
```bash
232+
az storage account create \
233+
--name strblobdataowner \
234+
--resource-group rg-rbac-demo \
235+
--location westeurope \
236+
--sku Standard_LRS
237+
```
238+
239+
Capture the storage account resource ID:
240+
241+
```bash
242+
STORAGE_ID=$(az storage account show \
243+
--name strblobdataowner \
244+
--resource-group rg-rbac-demo \
245+
--query id \
246+
--output tsv)
247+
```
248+
249+
Assign `Storage Blob Data Owner` at the storage account scope:
250+
251+
```bash
252+
az role assignment create \
253+
--assignee "$PRINCIPAL_ID" \
254+
--role "Storage Blob Data Owner" \
255+
--scope "$STORAGE_ID"
256+
```
257+
258+
```bash title="Output"
259+
{
260+
"condition": null,
261+
"conditionVersion": null,
262+
"createdBy": null,
263+
"createdOn": null,
264+
"delegatedManagedIdentityResourceId": null,
265+
"description": null,
266+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Storage/storageAccounts/strblobdataowner/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
267+
"name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
268+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
269+
"principalType": "ServicePrincipal",
270+
"roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
271+
"scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Storage/storageAccounts/strblobdataowner",
272+
"type": "Microsoft.Authorization/roleAssignments",
273+
"updatedBy": null,
274+
"updatedOn": null
275+
}
276+
```
277+
278+
List assignments scoped to the storage account to verify:
279+
280+
```bash
281+
az role assignment list --scope "$STORAGE_ID"
282+
```
283+
284+
```bash title="Output"
285+
[
286+
{
287+
"condition": null,
288+
"conditionVersion": null,
289+
"createdBy": null,
290+
"createdOn": null,
291+
"delegatedManagedIdentityResourceId": null,
292+
"description": null,
293+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Storage/storageAccounts/strblobdataowner/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
294+
"name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
295+
"principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
296+
"principalName": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
297+
"principalType": "ServicePrincipal",
298+
"roleDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
299+
"roleDefinitionName": "Storage Blob Data Owner",
300+
"scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-rbac-demo/providers/Microsoft.Storage/storageAccounts/strblobdataowner",
301+
"type": "Microsoft.Authorization/roleAssignments",
302+
"updatedBy": null,
303+
"updatedOn": null
304+
}
305+
]
306+
```
307+
308+
### Delete a role assignment
309+
310+
Delete the role assignment and confirm it no longer appears in the list:
311+
312+
```bash
313+
az role assignment delete \
314+
--assignee "$PRINCIPAL_ID" \
315+
--role Contributor \
316+
--scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/rg-rbac-demo"
317+
```
318+
319+
## Features
320+
321+
- **Role assignment creation:** Create role assignments by specifying an assignee principal ID, role name or ID, and scope.
322+
- **Assignment listing:** List role assignments at subscription scope, resource group scope, or filtered by assignee.
323+
- **Assignee filtering:** Filter assignments by principal ID or display name.
324+
- **Subscription-wide listing:** Retrieve all role assignments across a subscription via `--all`.
325+
- **Role assignment deletion:** Delete assignments by role name, assignee, and scope.
326+
- **Custom role support:** Assign custom role definitions alongside built-in roles.
327+
328+
## Limitations
329+
330+
- **RBAC not enforced:** Role assignments are stored but not evaluated. All operations on LocalStack succeed regardless of assigned roles.
331+
- **Condition-based assignments:** Attribute-based access control (ABAC) conditions in assignments are accepted at the model level but are not evaluated.
332+
- **Deny assignments:** `Microsoft.Authorization/denyAssignments` are not supported.
333+
- **Management group scopes:** Assignments at management group scope are not supported.
334+
335+
## Samples
336+
337+
The following sample demonstrates how to use Azure Role Assignments with LocalStack for Azure:
338+
339+
- [Function App and Service Bus](https://github.com/localstack/localstack-azure-samples/samples/function-app-service-bus/dotnet/README.md)
340+
- [Web App and Cosmos DB for MongoDB API ](https://github.com/localstack/localstack-azure-samples/samples/web-app-cosmosdb-mongodb-api/python/README.md)
341+
342+
## API Coverage
343+
344+
<AzureFeatureCoverage service="Microsoft.Authorization" client:load />

0 commit comments

Comments
 (0)