azure-rbac

To assign least-privilege Azure RBAC, this skill analyzes the required permissions for an identity and matches them to the minimal built-in role definition available. It ensures your managed identity gets only the permissions required and no more.

Generating Bicep code for an Azure RBAC role assignment involves selecting the correct role definition and principal. This skill produces deployment-ready Bicep snippets alongside Azure CLI commands to securely assign the chosen role.

Creating a custom Azure RBAC role is necessary when no built-in role matches your exact permission requirements. This skill generates a custom role definition tailored to your identity's specific needs while maintaining least privilege.

Yes, configuring Azure RBAC assignments requires roleAssignments write permissions on the target scope. This skill accounts for this prerequisite during the least-privilege discovery and deployment artifact generation process.

The best way to avoid over-permissioning an Azure managed identity is to apply least-privilege discovery. This skill identifies the minimal role definition needed for your specific resource access and generates the exact assignment artifacts.