azure-rbac

The azure-rbac skill is designed to simplify the process of assigning Azure Role-Based Access Control (RBAC) roles to identities while ensuring least privilege access. It addresses the common challenge of determining the minimal set of permissions necessary for an identity to perform specific tasks, and then generating the appropriate Azure CLI commands or Bicep code to enforce those permissions. By guiding users to the most appropriate built-in or custom roles, this skill helps prevent over-permissioning, which is a critical security concern in cloud environments.

This skill provides several key capabilities. It can identify the minimal built-in role that matches the desired permissions for an identity, and if no suitable role exists, it facilitates the creation of a custom role definition. It also generates the necessary CLI commands to assign the selected role and provides Bicep code snippets for infrastructure-as-code scenarios. Additionally, it offers guidance on the permissions required to assign roles, ensuring users understand the prerequisites, such as needing the User Access Administrator, Owner, or a custom role with `Microsoft.Authorization/roleAssignments/write` permissions. These features streamline RBAC management and reduce the risk of misconfiguration.

The azure-rbac skill is particularly useful for cloud administrators, DevOps engineers, and developers who manage Azure resources and need to enforce secure, least-privilege access. Common use cases include determining which role to assign for reading storage blobs, assigning roles to managed identities, creating custom roles with precise permissions, and automating role assignments through CLI or Bicep templates. By providing clear guidance and automation, this skill supports efficient and secure role management in enterprise and project-level Azure environments.