azure-role-selector

List the exact actions the identity must perform, separating control-plane actions from data-plane dataActions, then find the built-in role covering them with the least excess. Assign it at the narrowest scope, preferring resource over resource group over subscription.

Use the azurerm_role_assignment resource with scope, role_definition_name, and principal_id arguments. For custom roles, define an azurerm_role_definition with explicit permissions and assignable_scopes, then reference it in the assignment.

Create a custom role only when no built-in role covers the required actions without excessive permissions. The custom definition should list only the necessary actions and dataActions with an explicit assignable_scopes list.

Owner and Contributor include Microsoft.Authorization/* permissions, letting the identity grant itself more access. Assigning them at subscription or management-group scope to a workload identity creates a serious privilege-escalation risk.

Bicep and ARM output is out of scope for this kit's deliverables. The Skill produces Terraform azurerm_role_assignment resources, using Bicep tooling only optionally for exploration or comparison.