azureazure-storage-accountazure-rbac

is it possible to create Custom RBAC role for 1 specific resource?


I`ve created custom RBAC role for my personal storage account, the assignment scope is on resource group level. The issue is other storage accounts are also present in this resource group. So the question is, is there a way to somehow isolate this custom newly created role to my own storage account?

Thank you in advance!


Solution

  • Is it possible to create a custom RBAC role for one specific resource?

    According to this MS-Document,

    No, it is not possible to assign a custom role to a specific resource.

    The assignable scopes has limit access to custom roles at these scopes: management group, subscription, and resource group level.

    You can see at the resource group level, it has an option like a custom role in the portal.

    Portal:

    enter image description here

    In a specific resource like a storage account, there is no such option.

    Portal:

    enter image description here

    In your scenario, you need to place all storage accounts for which you need to create a custom role in one resource group.

    Reference: azure active directory - How can I create a custom role applicable to a specific resource type? - Stack Overflow by Sridevi.