azure-role-selector_skill

Overview

This skill helps you choose the least-privilege Azure role for an identity based on the exact permissions you need and produces the commands and infrastructure-as-code snippet to apply it. It identifies built-in roles that match your requirements or creates a custom role when necessary. It also generates Azure CLI commands and a Bicep code example for the role assignment.

How this skill works

You describe the actions or resource permissions the identity needs and the skill searches role definitions to find the minimal built-in role that covers those permissions. If no built-in role matches exactly, the skill constructs a custom role definition with only the requested permissions. Finally, it generates the Azure CLI commands to create/assign the role and provides a ready-to-use Bicep snippet to add the role assignment in infrastructure code.

When to use it

• Granting an identity access with least privilege to specific Azure resources
• Verifying whether a built-in role is sufficient before creating a custom role
• Preparing CLI commands for manual deployment or scripts
• Embedding role assignments in Bicep templates for automated deployments
• Auditing and reducing over-permissive role assignments

Best practices

• Aim to use built-in roles when they exactly match required permissions to avoid custom role maintenance
• Document the purpose and scope (scope, principalId) when creating custom roles
• Limit role scope to the smallest resource or resource group necessary
• Test custom roles in a non-production subscription before wide rollout
• Rotate and review role assignments regularly and remove unused identities

Example use cases

• Assigning read-only access to a specific storage account for a CI pipeline identity
• Providing VM start/stop permissions to an automation identity without full contributor rights
• Creating a custom role that allows only specific Key Vault secret operations for an app
• Generating Azure CLI commands to script role assignment as part of a deployment job
• Adding a role assignment to a Bicep module to ensure infra-as-code manages access