Microsoft Azure - Custom Roles
Creating Custom Azure Roles for InsightCloudSec
This article details how to create or customize roles within Microsoft Azure. For most scenarios within InsightCloudSec, though, using the Azure-created roles is appropriate.
For any questions about the content provided here feel free to reach out to us through the Customer Support Portal.
Prerequisite Roles
To access services through InsightCloudSec, we recommend using either a standard read-only role or a power-user role.
If you are interested in operating in a read-only fashion, which will prevent InsightCloudSec from taking actions against your Microsoft Azure resources, then we recommend using the InsightCloudSec Standard "Reader" User role. This role will grant InsightCloudSec read-only permissions to supported resources, so that it can harvest data and report on it.
If you would like to use InsightCloudSec to manage your Microsoft Azure resources directly or through the use of Bots, then use the InsightCloudSec Power User role. The InsightCloudSec Power User role will grant InsightCloudSec all permissions to supported resources so it can act upon cloud resources in addition to monitoring and reporting on them.
You may wish to start with InsightCloudSec Standard User until you are more familiar with how to use InsightCloudSec and then change to InsightCloudSec Power User when you are ready to use all of the capabilities InsightCloudSec has to offer.
Permission Note
The
"Microsoft.ContainerRegistry/registries/pull/read"
permission is included in the power user, standard user, and reader plus roles as it needs to be explicit if not using one of the built-in Owner, Contributor, or AcrPull roles.
InsightCloudSec Standard "Reader" User Role
Assignable Scopes
Note the
"AssignableScopes"
at the bottom of this file will need to be slightly different if you're configuring an Azure Organization.
{
"Name": "InsightCloudSec Standard User",
"Id": null,
"IsCustom": true,
"Description": "Provides read-only access to resources supported by InsightCloudSec.",
"Actions": [
"Microsoft.Advisor/recommendations/read",
"Microsoft.Authorization/classicAdministrators/read",
"Microsoft.Authorization/locks/read",
"Microsoft.Authorization/policyAssignments/read",
"Microsoft.Authorization/policyDefinitions/read",
"Microsoft.Authorization/policySetDefinitions/read",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Batch/batchAccounts/read",
"Microsoft.Batch/batchAccounts/pools/read",
"Microsoft.Cache/redis/read",
"Microsoft.Cache/redis/firewallRules/read",
"Microsoft.Cdn/profiles/read",
"Microsoft.Compute/disks/read",
"Microsoft.Compute/galleries/read",
"Microsoft.Compute/galleries/images/read",
"Microsoft.Compute/galleries/images/versions/read",
"Microsoft.Compute/hostGroups/read",
"Microsoft.Compute/images/read",
"Microsoft.Compute/skus/read",
"Microsoft.Compute/snapshots/read",
"Microsoft.Compute/virtualMachineScaleSets/extensions/read",
"Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
"Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
"Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read",
"Microsoft.Compute/virtualMachineScaleSets/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/publicIPAddresses/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
"Microsoft.Compute/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachines/instanceView/read",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.ContainerInstance/containerGroups/read",
"Microsoft.ContainerRegistry/registries/pull/read",
"Microsoft.ContainerRegistry/registries/read",
"Microsoft.ContainerService/managedClusters/read",
"Microsoft.Databricks/workspaces/read",
"Microsoft.DataFactory/factories/read",
"Microsoft.DataLakeStore/accounts/read",
"Microsoft.DBforMariaDB/locations/performanceTiers/read",
"Microsoft.DBforMariaDB/performanceTiers/read",
"Microsoft.DBforMariaDB/servers/configurations/read",
"Microsoft.DBforMariaDB/servers/firewallRules/read",
"Microsoft.DBforMariaDB/servers/read",
"Microsoft.DBforMariaDB/servers/virtualNetworkRules/read",
"Microsoft.DBforMySQL/flexibleServers/configurations/read",
"Microsoft.DBforMySQL/flexibleServers/firewallRules/read",
"Microsoft.DBforMySQL/flexibleServers/read",
"Microsoft.DBforMySQL/locations/performanceTiers/read",
"Microsoft.DBforMySQL/performanceTiers/read",
"Microsoft.DBforMySQL/servers/administrators/read",
"Microsoft.DBforMySQL/servers/configurations/read",
"Microsoft.DBforMySQL/servers/firewallRules/read",
"Microsoft.DBforMySQL/servers/keys/read",
"Microsoft.DBforMySQL/servers/read",
"Microsoft.DBforMySQL/servers/virtualNetworkRules/read",
"Microsoft.DBforPostgreSQL/flexibleServers/configurations/read",
"Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read",
"Microsoft.DBforPostgreSQL/flexibleServers/read",
"Microsoft.DBforPostgreSQL/locations/performanceTiers/read",
"Microsoft.DBforPostgreSQL/performanceTiers/read",
"Microsoft.DBforPostgreSQL/servers/administrators/read",
"Microsoft.DBforPostgreSQL/servers/configurations/read",
"Microsoft.DBforPostgreSQL/servers/firewallRules/read",
"Microsoft.DBforPostgreSQL/servers/keys/read",
"Microsoft.DBforPostgreSQL/servers/read",
"Microsoft.DBforPostgreSQL/servers/virtualNetworkRules/read",
"Microsoft.DocumentDB/databaseAccounts/read",
"Microsoft.DocumentDB/databaseAccounts/usages/read",
"Microsoft.EventHub/namespaces/eventhubs/read",
"Microsoft.EventHub/namespaces/networkruleset/read",
"Microsoft.EventHub/namespaces/networkrulesets/read",
"Microsoft.EventHub/namespaces/read",
"Microsoft.HDInsight/clusters/read",
"Microsoft.Insights/DiagnosticSettings/Read",
"Microsoft.Insights/LogProfiles/read",
"Microsoft.KeyVault/vaults/read",
"Microsoft.Logic/workflows/read",
"Microsoft.Network/applicationGateways/read",
"Microsoft.Network/azurefirewalls/read",
"Microsoft.Network/dnszones/A/read",
"Microsoft.Network/dnszones/AAAA/read",
"Microsoft.Network/dnszones/CAA/read",
"Microsoft.Network/dnszones/CNAME/read",
"Microsoft.Network/dnszones/MX/read",
"Microsoft.Network/dnszones/NS/read",
"Microsoft.Network/dnszones/PTR/read",
"Microsoft.Network/dnszones/SOA/read",
"Microsoft.Network/dnszones/SRV/read",
"Microsoft.Network/dnszones/TXT/read",
"Microsoft.Network/dnszones/read",
"Microsoft.Network/dnszones/recordsets/read",
"Microsoft.Network/expressRouteCircuits/read",
"Microsoft.Network/frontDoors/read",
"Microsoft.Network/ipGroups/read",
"Microsoft.Network/loadBalancers/backendAddressPools/read",
"Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
"Microsoft.Network/loadBalancers/networkInterfaces/read",
"Microsoft.Network/loadBalancers/read",
"Microsoft.Network/locations/usages/read",
"Microsoft.Network/natGateways/read",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Network/networkSecurityGroups/read",
"Microsoft.Network/networkWatchers/configureFlowLog/action",
"Microsoft.Network/networkWatchers/flowLogs/read",
"Microsoft.Network/networkWatchers/queryFlowLogStatus/action",
"Microsoft.Network/networkWatchers/read",
"Microsoft.Network/privateDnsZones/A/read",
"Microsoft.Network/privateDnsZones/AAAA/read",
"Microsoft.Network/privateDnsZones/CNAME/read",
"Microsoft.Network/privateDnsZones/MX/read",
"Microsoft.Network/privateDnsZones/PTR/read",
"Microsoft.Network/privateDnsZones/SOA/read",
"Microsoft.Network/privateDnsZones/SRV/read",
"Microsoft.Network/privateDnsZones/TXT/read",
"Microsoft.Network/privateDnsZones/read",
"Microsoft.Network/privateDnsZones/recordsets/read",
"Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
"Microsoft.Network/privateEndpoints/read",
"Microsoft.Network/publicIPAddresses/read",
"Microsoft.Network/routeTables/read",
"Microsoft.Network/serviceEndpointPolicies/read",
"Microsoft.Network/trafficManagerProfiles/read",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
"Microsoft.Network/virtualnetworks/read",
"Microsoft.Network/virtualNetworkGateways/read",
"Microsoft.OperationalInsights/workspaces/read",
"Microsoft.Resources/subscriptions/locations/read",
"Microsoft.Resources/subscriptions/providers/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourcegroups/resources/read",
"Microsoft.Search/searchServices/read",
"Microsoft.Security/advancedThreatProtectionSettings/read",
"Microsoft.Security/alerts/read",
"Microsoft.Security/assessments/read",
"Microsoft.Security/assessments/*/read",
"Microsoft.Security/autoProvisioningSettings/read",
"Microsoft.Security/locations/jitNetworkAccessPolicies/read",
"Microsoft.Security/pricings/read",
"Microsoft.Security/securityContacts/read",
"Microsoft.Security/tasks/read",
"Microsoft.ServiceBus/namespaces/networkRuleSets/read",
"Microsoft.ServiceBus/namespaces/queues/read",
"Microsoft.ServiceBus/namespaces/read",
"Microsoft.Sql/managedInstances/administrators/read",
"Microsoft.Sql/managedInstances/encryptionProtector/read",
"Microsoft.Sql/managedInstances/read",
"Microsoft.Sql/managedInstances/securityAlertPolicies/read",
"Microsoft.Sql/managedInstances/vulnerabilityAssessments/read",
"Microsoft.Sql/servers/administrators/read",
"Microsoft.Sql/servers/auditingSettings/read",
"Microsoft.Sql/servers/databases/auditingSettings/read",
"Microsoft.Sql/servers/databases/extendedAuditingSettings/read",
"Microsoft.Sql/servers/databases/read",
"Microsoft.Sql/servers/databases/securityAlertPolicies/read",
"Microsoft.Sql/servers/databases/skus/read",
"Microsoft.Sql/servers/databases/transparentDataEncryption/read",
"Microsoft.Sql/servers/extendedAuditingSettings/read",
"Microsoft.Sql/servers/encryptionProtector/read",
"Microsoft.Sql/servers/firewallRules/read",
"Microsoft.Sql/servers/read",
"Microsoft.Sql/servers/securityAlertPolicies/read",
"Microsoft.Sql/servers/virtualNetworkRules/read",
"Microsoft.Sql/servers/vulnerabilityAssessments/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/read",
"Microsoft.Storage/storageAccounts/fileServices/shares/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Synapse/workspaces/read",
"Microsoft.Web/serverfarms/read",
"Microsoft.Web/sites/read",
"Microsoft.Web/sites/config/read",
"Microsoft.Web/sites/config/list/Action",
"Microsoft.Web/sites/functions/read",
"Microsoft.Web/sites/privateEndpointConnections/read",
"Microsoft.Web/sites/slots/read",
"Microsoft.Web/sites/slots/config/read",
"Microsoft.Web/sites/slots/config/list/Action",
"Microsoft.Web/sites/slots/functions/read",
"microsoft.web/sites/slots/virtualnetworkconnections/read",
"microsoft.web/sites/virtualnetworkconnections/read"
],
"NotActions": [],
"AssignableScopes": [
"/subscriptions/00000000-0000-0000-0000-000000000000",
"/subscriptions/11111111-1111-1111-1111-111111111111"
]
}
Subscription Details
For the subscription section in the code snippets above (and below), replace the 000s and 111s with YOUR SUBSCRIPTION ID. If you are only setting this up for one subscription, you can remove the line with the 111s; you should also remove the comma in the line above it (the line with the 000s).
InsightCloudSec Power User Role
{
"Name": "InsightCloudSec Power User",
"Id": null,
"IsCustom": true,
"Description": "Provides full access to resources supported by InsightCloudSec.",
"Actions": [
"Microsoft.Advisor/*",
"Microsoft.Authorization/*",
"Microsoft.Batch/*",
"Microsoft.Cache/*",
"Microsoft.Compute/*",
"Microsoft.ContainerInstance/*",
"Microsoft.ContainerRegistry/*",
"Microsoft.ContainerService/*",
"Microsoft.Databricks/*",
"Microsoft.DataFactory/*",
"Microsoft.DataLakeStore/*",
"Microsoft.DBforMariaDB/*",
"Microsoft.DBforMySQL/*",
"Microsoft.DBforPostgreSQL/*",
"Microsoft.DocumentDB/*",
"Microsoft.EventHub/*",
"Microsoft.HDInsight/*",
"Microsoft.Insights/*",
"Microsoft.KeyVault/*",
"Microsoft.Logic/*",
"Microsoft.Network/*",
"Microsoft.OperationalInsights/*",
"Microsoft.Resources/*",
"Microsoft.Search/*",
"Microsoft.Security/*",
"Microsoft.ServiceBus/*",
"Microsoft.Sql/*",
"Microsoft.Storage/*",
"Microsoft.Synapse/*",
"Microsoft.Web/*"
],
"NotActions": [],
"AssignableScopes": [
"/subscriptions/00000000-0000-0000-0000-000000000000",
"/subscriptions/11111111-1111-1111-1111-111111111111"
]
}
InsightCloudSec Reader Plus Role
InsightCloudSec recommends using the Standard "Reader" role for read-only permissions to all resources. Adding the following will provide what we're calling the "Reader Plus Role".
"Microsoft.Web/sites/config/list/Action",
"Microsoft.Web/sites/slots/config/list/Action"
For the permissions above, the config/list/Action
permission provides visibility to determine if Web Apps are configured to require authentication and for Serverless Functions to determine if the function is enabled/disabled. The caveat is that those permissions also provide access to any environment variables configured for WebApps, which may contain sensitive information.
{
"Name": "InsightCloudSec Reader Plus",
"Id": null,
"IsCustom": true,
"Description": "Provides read-only access to all Azure resources plus some additional permissions not covered by the built-in Reader role.",
"Actions": [
"*/read",
"Microsoft.ContainerRegistry/registries/pull/read",
"Microsoft.Web/sites/config/list/Action",
"Microsoft.Web/sites/slots/config/list/Action"
],
"NotActions": [],
"AssignableScopes": [
"/subscriptions/00000000-0000-0000-0000-000000000000",
"/subscriptions/11111111-1111-1111-1111-111111111111"
]
}
Creating Custom Roles
To add one of these roles to your account, copy the JSON from one of the desired roles above into a file and use either PowerShell or Azure CLI from the command line to create the role.
Azure CLI (Recommended)
If you don't have the Azure CLI set up, you can install it from the Microsoft Azure documentation.
PowerShell
New-AzureRmRoleDefinition -InputFile <role_definition>
Azure CLI
az role definition create --role-definition <role_definition>
Updating Custom Roles
To modify an existing custom role:
Retrieve the existing role with either PowerShell or Azure CLI.
PowerShell
Get-AzureRmRoleDefinition -Custom | ConvertTo-Json
Azure CLI
az role definition list --custom-role-only
Copy the JSON for the custom role you wish to modify into a new file and make the desired changes to the role definition. Then update the role in Azure.
PowerShell
Set-AzureRmRoleDefinition -InputFile <role_definition>
Azure CLI
az role definition update --role-definition <role_definition>
With these roles defined, return to Microsoft Azure to connect your Azure account with InsightCloudSec.
Updated about 12 hours ago