Azure Custom RBAC with wildcard in assinableScopes - is it possible? - azure

Question

I am trying to create Azure Custom RBAC and it accepts wildcard in action/noaction but it does not work when I try wildcard in assinableScopes.
I need to restrict permissions for certain resource group but I don't know the exact name of the resource group. However, I do know the naming convention and I would like to be able to use wildcard in the assinableScopes.
Example of what I would like to do but Azure does not allow:
{
"properties": {
"roleName": "MySampleCustomRole",
"description": "My Sample Custom Role",
"assignableScopes": [
"/subscriptions/*/resourceGroups/ABCDXYZ-*"
],
"permissions": [{
"actions": [],
"notActions": [
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/beginGetAccess/action",
"Microsoft.Compute/snapshots/endGetAccess/action",
"Microsoft.Compute/disks/beginGetAccess/action"
],
"dataActions": [],
"notDataActions": []
}
]
}
}

Answer 1

I agree with #Roderick Bant, it's not possible to use wildcards in assignable scopes.
I tried to reproduce the same in my environment and got below results:
I have few resource groups with naming convention starts with test in my subscription.
When I tried to create custom RBAC role by including wildcard in assignable scopes as test*, I got error like below:
PUT https://management.azure.com/subscriptions/<subID>/resourceGroups/test*/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}?api-version=2022-04-01
{
"properties": {
"roleName": "MySampleCustomRole",
"description": "My Sample Custom Role",
"assignableScopes": [
"/subscriptions/<subID>/resourceGroups/test*"
],
"permissions": [{
"actions": [],
"notActions": [
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/beginGetAccess/action",
"Microsoft.Compute/snapshots/endGetAccess/action",
"Microsoft.Compute/disks/beginGetAccess/action"
],
"dataActions": [],
"notDataActions": []
}
]
}
}
}
Response:
Use below CLI command to get the exact name of resource groups with naming convention test :
az group list --query "[?contains(name,'test')].name"
Response:
Instead of including wildcard in assignableScopes , the only way for now is to pass the above names one by one while creating custom RBAC role like below:
PUT https://management.azure.com/subscriptions/<subID>/resourceGroups/testrg/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}?api-version=2022-04-01
{
"properties": {
"roleName": "MySampleCustomRole",
"description": "My Sample Custom Role",
"assignableScopes": [
"/subscriptions/<subID>/resourceGroups/testrg",
"/subscriptions/<subID>/resourceGroups/testsri",
"/subscriptions/<subID>/resourceGroups/testdevi"
],
"permissions": [{
"actions": [],
"notActions": [
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/beginGetAccess/action",
"Microsoft.Compute/snapshots/endGetAccess/action",
"Microsoft.Compute/disks/beginGetAccess/action"
],
"dataActions": [],
"notDataActions": []
}
]
}
}
}
Response:
When I checked the same in Portal, the above custom role is available in only test* resource groups as mentioned in assignableScopes like below:
testrg:
testsri:
testdevi:
When I checked the same in other resource groups from same subscription, custom role is not available like below:
Reference:
Azure custom role definition with special AssignableScopes - Stack Overflow by Joy Wang