Required Azure permissions

Cloud Management Platform (CMP) works entirely through Azure Resource Manager. Register the application as described in Configure the Azure portal, then assign it one of the roles below at subscription scope. A role scoped to individual resource groups cannot read what CMP needs from the subscription as a whole: existing servers to discover, available regions and virtual machine sizes, stored SSH public keys, and cost.

Contributor

Assign the built-in Contributor role to the application at subscription scope. It covers everything CMP does: creating and deleting virtual machines, disks, network interfaces, security groups, public IP addresses, storage accounts, availability sets, and resource groups; power actions; resizing; snapshots; load balancers; tagging; cost; and utilization metrics.

Reader, to import and monitor only

If CMP should only import and monitor existing Azure servers, with no provisioning, power actions, resizing, or deletion, assign Reader, as well as:

• Microsoft.Commerce/RateCard/read, for cost.
• Microsoft.Insights/metrics/read, for utilization.

A custom role, for least privilege

If your security policy requires least privilege, create a role containing only the actions CMP calls. It covers connection checks, discovery, region and image lookups, provisioning, power and resize, disks and snapshots, load balancers, tagging, deletion, cost, and metrics.

1. Save the following as Azure_CloudBolt_ARM_Role.json, replacing SUBSCRIPTION_ID with your subscription ID.

   {
     "Name": "CloudBolt ARM Operator",
     "IsCustom": true,
     "Description": "Minimum permissions for the CloudBolt CMP Azure resource handler.",
     "Actions": [
       "Microsoft.Resources/subscriptions/read",
       "Microsoft.Resources/subscriptions/locations/read",
       "Microsoft.Resources/subscriptions/resourceGroups/read",
       "Microsoft.Resources/subscriptions/resourceGroups/write",
       "Microsoft.Resources/subscriptions/resourceGroups/delete",
       "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
       "Microsoft.Resources/deployments/read",
       "Microsoft.Resources/deployments/write",
       "Microsoft.Resources/deployments/operations/read",
       "Microsoft.Compute/virtualMachines/read",
       "Microsoft.Compute/virtualMachines/write",
       "Microsoft.Compute/virtualMachines/delete",
       "Microsoft.Compute/virtualMachines/start/action",
       "Microsoft.Compute/virtualMachines/powerOff/action",
       "Microsoft.Compute/virtualMachines/deallocate/action",
       "Microsoft.Compute/virtualMachines/restart/action",
       "Microsoft.Compute/virtualMachines/runCommand/action",
       "Microsoft.Compute/virtualMachines/vmSizes/read",
       "Microsoft.Compute/virtualMachines/extensions/read",
       "Microsoft.Compute/virtualMachines/extensions/write",
       "Microsoft.Compute/virtualMachineScaleSets/read",
       "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
       "Microsoft.Compute/availabilitySets/read",
       "Microsoft.Compute/availabilitySets/write",
       "Microsoft.Compute/availabilitySets/delete",
       "Microsoft.Compute/disks/read",
       "Microsoft.Compute/disks/write",
       "Microsoft.Compute/disks/delete",
       "Microsoft.Compute/snapshots/read",
       "Microsoft.Compute/snapshots/write",
       "Microsoft.Compute/snapshots/delete",
       "Microsoft.Compute/images/read",
       "Microsoft.Compute/galleries/read",
       "Microsoft.Compute/galleries/images/read",
       "Microsoft.Compute/galleries/images/versions/read",
       "Microsoft.Compute/sshPublicKeys/read",
       "Microsoft.Compute/locations/vmSizes/read",
       "Microsoft.Compute/locations/publishers/read",
       "Microsoft.Compute/locations/publishers/artifacttypes/offers/read",
       "Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/read",
       "Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read",
       "Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read",
       "Microsoft.Network/networkInterfaces/read",
       "Microsoft.Network/networkInterfaces/write",
       "Microsoft.Network/networkInterfaces/delete",
       "Microsoft.Network/networkInterfaces/join/action",
       "Microsoft.Network/publicIPAddresses/read",
       "Microsoft.Network/publicIPAddresses/write",
       "Microsoft.Network/publicIPAddresses/delete",
       "Microsoft.Network/publicIPAddresses/join/action",
       "Microsoft.Network/networkSecurityGroups/read",
       "Microsoft.Network/networkSecurityGroups/write",
       "Microsoft.Network/networkSecurityGroups/delete",
       "Microsoft.Network/networkSecurityGroups/join/action",
       "Microsoft.Network/virtualNetworks/read",
       "Microsoft.Network/virtualNetworks/subnets/read",
       "Microsoft.Network/virtualNetworks/subnets/join/action",
       "Microsoft.Network/loadBalancers/read",
       "Microsoft.Network/loadBalancers/write",
       "Microsoft.Network/loadBalancers/delete",
       "Microsoft.Network/loadBalancers/backendAddressPools/read",
       "Microsoft.Network/loadBalancers/backendAddressPools/write",
       "Microsoft.Storage/storageAccounts/read",
       "Microsoft.Storage/storageAccounts/write",
       "Microsoft.Storage/storageAccounts/delete",
       "Microsoft.Storage/storageAccounts/listKeys/action",
       "Microsoft.Storage/checkNameAvailability/read",
       "Microsoft.Commerce/RateCard/read",
       "Microsoft.Insights/metrics/read",
       "Microsoft.Insights/metricDefinitions/read"
     ],
     "NotActions": [],
     "DataActions": [],
     "NotDataActions": [],
     "AssignableScopes": [
       "/subscriptions/SUBSCRIPTION_ID"
     ]
   }
   

2. Create the role.

   az role definition create --role-definition Azure_CloudBolt_ARM_Role.json
   

3. In the Azure portal, open the subscription, select Access control (IAM) > Add role assignment, and assign the new role to the application.