skills.rest
serpro-workshop-fortaleza
serpro-workshop-fortalezaOFFICIAL
Explore all skills by this author →
GitHub

azure-role-selector

Recommends least-privilege Azure RBAC roles and generates Terraform role assignments.

Updated Sep 10, 2026
Search Tags:#RBAC#azure#Terraform#IAM#least privilege#managed identity#role assignment
One-click install
npx skills add https://github.com/serpro-workshop-fortaleza/datacorp-sifap-modernization-team-kit --skill azure-role-selector-serpro-workshop-fortaleza
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: azure-role-selector
Source: https://github.com/serpro-workshop-fortaleza/datacorp-sifap-modernization-team-kit/tree/main/.github/skills/azure-role-selector
Command: npx skills add https://github.com/serpro-workshop-fortaleza/datacorp-sifap-modernization-team-kit --skill azure-role-selector-serpro-workshop-fortaleza

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Choosing the right Azure RBAC role for an identity is error-prone: teams often over-assign broad roles like Owner or Contributor, creating security risk. This Skill guides the selection of the most restrictive built-in role for the actions an identity needs and expresses the assignment as Terraform code. ## Core Features & Use Cases - Least-Privilege Role Selection: Maps required control-plane and data-plane actions to the narrowest built-in Azure role at the tightest scope. - Terraform Output: Generates ready-to-commit azurerm_role_assignment and azurerm_role_definition snippets, the IaC standard of this kit. - Custom Role Fallback: Creates a custom role definition with explicit assignable_scopes only when no built-in role fits. - Use Case: A developer asks which role lets a managed identity read blobs from one storage account. The Skill recommends Storage Blob Data Reader scoped to that account and outputs the corresponding Terraform resource. ## Quick Start Ask which Azure role to assign to a managed identity that needs read-only access to a storage account, and request the assignment as Terraform.

Frequently Asked Questions about azure-role-selector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose the least-privilege Azure RBAC role for a managed identity?▼

List the exact actions the identity must perform, separating control-plane actions from data-plane dataActions, then find the built-in role covering them with the least excess. Assign it at the narrowest scope: resource before resource group before subscription.

How to assign an Azure role using Terraform?▼

Use the azurerm_role_assignment resource with scope, role_definition_name, and principal_id pointing to the identity. For custom roles, define an azurerm_role_definition with explicit permissions and assignable_scopes, then reference it in the assignment.

When should I create a custom Azure role definition?▼

Create a custom role only when no built-in role covers the required actions without excessive extra permissions. The custom definition should list only the necessary actions and dataActions with an explicit assignableScopes.

Why should I avoid assigning Owner or Contributor to workload identities?▼

Owner and Contributor include Microsoft.Authorization/* permissions, which let the identity grant itself more access. Assigning them at subscription or management group scope to a workload identity creates a serious privilege-escalation risk.

Does this Skill support Bicep or ARM templates for role assignments?▼

Bicep and ARM snippets are optional and out of scope for this kit's deliverables. The Skill produces Terraform azurerm_role_assignment output, using Bicep only for exploration or comparison via Azure MCP tools.

Related Skills

Explore More Software Engineering Skills→
TheViziusGroupTheViziusGroup
1

azure-rbac

Configure Azure role assignments, managed identities, and data plane permissions across scopes.

Official
Advanced
ntaksh42ntaksh42
1

terraform-azure-devops

Generate Terraform configurations for Azure DevOps projects, repositories, pipelines, and variables.

Community
Intermediate
AlahmadiQ8AlahmadiQ8
1

azure-rbac

Finds least-privilege Azure RBAC roles and generates CLI and Bicep role assignment code.

Community
Basic
0xMerl990xMerl99
1

azure

Manage Microsoft Azure infrastructure with Bicep and ARM templates.

Community
Advanced