azure-rbac
尋找最小的 Azure RBAC 角色，生成指派命令，並提供 Bicep 基礎結構程式碼。使用 Azure 文件識別符合所需權限的內建角色，或在沒有合適內建角色時建立自訂角色定義。產生 Azure CLI 命令和 Bicep 程式碼片段，用於將角色指派給身分識別、服務主體和受控身分識別。釐清授予角色的先決條件，包括哪些權限（Microsoft.Authorization/roleAssignments/write）...
npx skills add https://github.com/microsoft/azure-skills --skill azure-rbacUse the 'azure__documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity. If no built-in role matches the desired permissions, use the 'azure__extension_cli_generate' tool to create a custom role definition with the desired permissions. Then use the 'azure__extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity. Finally, use the 'azure__bicepschema' and 'azure__get_azure_bestpractices' tools to provide a Bicep code snippet for adding the role assignment. If user is asking about role necessary to set access, refer to Prerequisites for Granting Roles down below:
Prerequisites for Granting Roles
To assign RBAC roles to identities, you need a role that includes the Microsoft.Authorization/roleAssignments/write permission. The most common roles with this permission are:
- User Access Administrator (least privilege - recommended for role assignment only)
- Owner (full access including role assignment)
- Custom Role with
Microsoft.Authorization/roleAssignments/write