For the complete documentation index, see llms.txt. This page is also available as Markdown.

Create a custom role

Create a custom Azure role with the Azure CLI or Terraform to grant standard or administrator access to VMs reached through a P0 jump host or bastion host.

When the built-in Azure roles don't fit your needs, you can create a custom role and point P0's Standard user role id or Admin user role id field at it. This guide creates that custom role with the Azure CLI or Terraform.

The steps create the standard user role, which grants the permissions needed to reach VMs through a jump host or bastion host over Azure IAM. To create the admin user role, which adds sudo access on the target VM, give the role a distinct name and add the admin data action noted in each step.

P0 recommends two built-in roles you can use instead of a custom role: Virtual Machine User Login (fb879df8-f326-4884-b1cf-06f3ad86be52) for standard access and Virtual Machine Administrator Login (1c0163c0-47e6-4577-8991-ea5c82e286e4) for admin access. Create a custom role only when neither built-in role fits your needs.

Prerequisites

  • Permission to create custom roles in the subscription, such as the built-in User Access Administrator or Owner role.

  • The Azure CLI or Terraform installed, depending on which tool you use. See the Azure CLI installation guide or the Terraform installation guide.

  • Your Azure subscription ID.

Permissions granted

The role grants the following permissions. The read actions let the connecting user resolve the jump host and target VM network configuration. The data actions let the user sign in to the VM through the Azure AD login for Linux extension.

Permission
Type
Purpose

Microsoft.Network/publicIPAddresses/read

Action

Resolve public IP addresses

Microsoft.Network/virtualNetworks/read

Action

Resolve virtual network configuration

Microsoft.Network/loadBalancers/read

Action

Resolve load balancer configuration

Microsoft.Network/networkInterfaces/read

Action

Resolve network interface configuration

Microsoft.Compute/virtualMachines/*/read

Action

Read virtual machine configuration

Microsoft.Compute/virtualMachines/login/action

Data action

Sign in to the VM as a standard user

Microsoft.Compute/virtualMachines/loginAsAdmin/action

Data action

Sign in to the VM as an administrator with sudo privileges (admin user role only)

Create the role

  1. Save the role definition to a file named standard-user-role.json. Replace {subscriptionId} with your subscription ID:

    To create the admin user role instead, change Name to a distinct value and add "Microsoft.Compute/virtualMachines/loginAsAdmin/action" to DataActions.

  2. Create the role:

  3. Retrieve the role definition ID:

    The command returns an ID in the format /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{guid}. This value is the role definition ID you enter in P0.

  1. Declare an azurerm_role_definition resource. Set subscription_id to your subscription ID:

    To create the admin user role instead, use a distinct resource name and role name, and add "Microsoft.Compute/virtualMachines/loginAsAdmin/action" to data_actions.

  2. Apply the configuration:

    The standard_user_role_id output holds the role definition ID, in the format /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{guid}. This value is the role definition ID you enter in P0.

Next step

Enter the role definition ID in the appropriate P0 field:

Last updated