Create a custom role

Create a custom Azure role with the Azure CLI or Terraform to grant standard or administrator access to VMs reached through a P0 jump host or bastion host.

When the built-in Azure roles don't fit your needs, you can create a custom role and point P0's Standard user role id or Admin user role id field at it. This guide creates that custom role with the Azure CLI or Terraform.

The steps create the standard user role, which grants the permissions needed to reach VMs through a jump host or bastion host over Azure IAM. To create the admin user role, which adds sudo access on the target VM, give the role a distinct name and add the admin data action noted in each step.

P0 recommends two built-in roles you can use instead of a custom role: Virtual Machine User Login (fb879df8-f326-4884-b1cf-06f3ad86be52) for standard access and Virtual Machine Administrator Login (1c0163c0-47e6-4577-8991-ea5c82e286e4) for admin access. Create a custom role only when neither built-in role fits your needs.

Prerequisites

• Permission to create custom roles in the subscription, such as the built-in User Access Administrator or Owner role.

• The Azure CLI or Terraform installed, depending on which tool you use. See the Azure CLI installation guide or the Terraform installation guide.

• Your Azure subscription ID.

Permissions granted

The role grants the following permissions. The read actions let the connecting user resolve the jump host and target VM network configuration. The data actions let the user sign in to the VM through the Azure AD login for Linux extension.

Permission	Type	Purpose
Microsoft.Network/publicIPAddresses/read	Action	Resolve public IP addresses
Microsoft.Network/virtualNetworks/read	Action	Resolve virtual network configuration
Microsoft.Network/loadBalancers/read	Action	Resolve load balancer configuration
Microsoft.Network/networkInterfaces/read	Action	Resolve network interface configuration
Microsoft.Compute/virtualMachines/*/read	Action	Read virtual machine configuration
Microsoft.Compute/virtualMachines/login/action	Data action	Sign in to the VM as a standard user
Microsoft.Compute/virtualMachines/loginAsAdmin/action	Data action	Sign in to the VM as an administrator with sudo privileges (admin user role only)

Create the role

Azure CLI

1. Save the role definition to a file named standard-user-role.json. Replace {subscriptionId} with your subscription ID:

   {
     "Name": "P0 VM Standard Login",
     "IsCustom": true,
     "Description": "Standard access to VMs reached through the P0 jump host.",
     "Actions": [
       "Microsoft.Network/publicIPAddresses/read",
       "Microsoft.Network/virtualNetworks/read",
       "Microsoft.Network/loadBalancers/read",
       "Microsoft.Network/networkInterfaces/read",
       "Microsoft.Compute/virtualMachines/*/read"
     ],
     "NotActions": [],
     "DataActions": [
       "Microsoft.Compute/virtualMachines/login/action"
     ],
     "NotDataActions": [],
     "AssignableScopes": [
       "/subscriptions/{subscriptionId}"
     ]
   }

   To create the admin user role instead, change Name to a distinct value and add "Microsoft.Compute/virtualMachines/loginAsAdmin/action" to DataActions.

2. Create the role:

   az role definition create --role-definition standard-user-role.json

3. Retrieve the role definition ID:

   az role definition list --name "P0 VM Standard Login" --query "[0].id" --output tsv

   The command returns an ID in the format /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{guid}. This value is the role definition ID you enter in P0.

Terraform

1. Declare an azurerm_role_definition resource. Set subscription_id to your subscription ID:

   resource "azurerm_role_definition" "p0_vm_standard_login" {
     name        = "P0 VM Standard Login"
     scope       = "/subscriptions/${var.subscription_id}"
     description = "Standard access to VMs reached through the P0 jump host."
   
     permissions {
       actions = [
         "Microsoft.Network/publicIPAddresses/read",
         "Microsoft.Network/virtualNetworks/read",
         "Microsoft.Network/loadBalancers/read",
         "Microsoft.Network/networkInterfaces/read",
         "Microsoft.Compute/virtualMachines/*/read",
       ]
       data_actions = [
         "Microsoft.Compute/virtualMachines/login/action",
       ]
     }
   
     assignable_scopes = [
       "/subscriptions/${var.subscription_id}",
     ]
   }
   
   output "standard_user_role_id" {
     value = azurerm_role_definition.p0_vm_standard_login.role_definition_resource_id
   }

   To create the admin user role instead, use a distinct resource name and role name, and add "Microsoft.Compute/virtualMachines/loginAsAdmin/action" to data_actions.

2. Apply the configuration:

   terraform init
   terraform apply

   The standard_user_role_id output holds the role definition ID, in the format /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{guid}. This value is the role definition ID you enter in P0.

Next step

Enter the role definition ID in the appropriate P0 field:

• For a custom jump host, see Custom jump host.

• For an Azure bastion host, see Azure bastion host.