skills.rest
lettucebo
lettuceboCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

azure-role-selector

Selects least-privilege Azure roles and generates assignment commands and Bicep snippets.

Updated Mar 25, 2026
Search Tags:#azure#rbac#iam#least privilege#azure cli#bicep#role assignment
One-click install
npx skills add https://github.com/lettucebo/Skills --skill azure-role-selector-lettucebo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: azure-role-selector
Source: https://github.com/lettucebo/Skills/tree/main/skills/azure/azure-role-selector
Command: npx skills add https://github.com/lettucebo/Skills --skill azure-role-selector-lettucebo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Choosing the right Azure role for an identity is error-prone: built-in roles are numerous, and over-privileged assignments create security risk. This Skill finds the minimal role matching the permissions you need and produces the commands to assign it. ## Core Features & Use Cases - Least-Privilege Role Matching: Searches Azure documentation to find the built-in role that exactly covers the desired permissions. - Custom Role Creation: Generates a custom role definition via Azure CLI when no built-in role fits the required permissions. - Assignment Automation: Produces Azure CLI commands for role assignment plus a Bicep snippet following Azure best practices. - Use Case: You need to grant a managed identity read access to a specific storage account. The Skill identifies the least-privilege built-in role, then outputs the az CLI command and Bicep code to assign it. ## Quick Start Ask the agent which Azure role grants read-only access to blob storage for a managed identity and have it generate the assignment CLI command and Bicep snippet.

Frequently Asked Questions about azure-role-selector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the least-privilege Azure role for specific permissions?▼

The Skill searches Azure documentation to match your desired permissions against built-in role definitions and returns the minimal role. If no built-in role fits, it generates a custom role definition containing only the required permissions.

How do I assign an Azure role to a managed identity using CLI?▼

The Skill generates the exact Azure CLI commands needed to assign the selected role to your identity, including the appropriate scope and principal parameters. It also produces an equivalent Bicep snippet for infrastructure-as-code deployments.

What happens when no built-in Azure role matches my permissions?▼

When no built-in role covers the exact permission set, the Skill uses the Azure CLI generation tool to create a custom role definition with only the desired permissions, preserving least-privilege access.

Can I get Bicep code for Azure role assignments?▼

Yes, the Skill uses the Azure Bicep schema and best-practices tools to produce a Bicep code snippet for the role assignment, suitable for inclusion in infrastructure-as-code templates.

What tools does this Skill require to work?▼

It requires Azure MCP tools: documentation search, bicepschema, extension_cli_generate, and get_bestpractices. These must be available in the agent environment for role lookup and code generation.

Related Skills

Explore More Software Engineering Skills→
MoonAxisMoonAxis

azure-role-selector

Identify least privilege Azure roles and generate CLI commands and Bicep code.

Official
Intermediate
jorgeasaurusjorgeasaurus
12

azure-rbac

Determine Azure RBAC roles and generate CLI and Bicep assignment code.

Community
Intermediate
sitharaj88sitharaj88
1

azure-rbac

Generate Azure RBAC assignments, custom roles, managed identities, and policies in Bicep, Terraform, and Azure CLI.

Community
Advanced
jongiojongio
6

azure-role-selector

Identifies least-privilege Azure RBAC built-in or custom roles and generates CLI/Bicep assignments.

Community
Intermediate