azure-active-directoryazure-rm-templateazure-cliazure-nsg

Update NSG with JSON definition. Only permission is contributor on the NSG resource

I have a file called nsg-properties.json which looks like this:

{
    "securityRules": [
        <twenty NSG rules are here>
    ]
}

I have a service principal with only a single role assignment, which is Contributor on the scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$VNET_RESOURCE_GROUP/providers/Microsoft.Network/networkSecurityGroups/$NSG_NAME which is the resource ID of my NSG.

How can I programmatically update the NSG with the property definition in nsg-properties.json? Things I've tried:

There's the az network nsg update API, but I can't figure out how to use a JSON definition as input.

Do you have any suggestions?

Solution

  • It cannot work like this. You need to give Network Contributor OR Microsoft.Network/networkSecurityGroups/write permission to your Service principle in order to update NSG. Check out Permissions required to make changes to NSG:

    enter image description here

    Edit:

    In the 2nd case you have mentioned:

    Use az resource create --id $NSG_ID --properties @nsg-properties.json. Didn't work, because my service principal doesn't have Microsoft.Resources/subscriptions/resourcegroups/read on the scope of my resource group.

    This is not possible without giving Microsoft.Resources/subscriptions/resourcegroups/read role to your SP. This is how the design is.