permissions

Creates, updates, deletes, gets or lists a permissions resource.

Overview

Name	permissions
Type	Resource
Id	azure.authorization.permissions

Fields

The following fields are returned by SELECT queries:

list_for_resource

Name	Datatype	Description
actions	array	Allowed actions.
condition	string	The conditions on the role definition. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'.
conditionVersion	string	Version of the condition. Currently the only accepted value is '2.0'.
dataActions	array	Allowed Data actions.
notActions	array	Denied actions.
notDataActions	array	Denied Data actions.

list_for_resource_group

Name	Datatype	Description
actions	array	Allowed actions.
condition	string	The conditions on the role definition. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'.
conditionVersion	string	Version of the condition. Currently the only accepted value is '2.0'.
dataActions	array	Allowed Data actions.
notActions	array	Denied actions.
notDataActions	array	Denied Data actions.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_for_resource	select	resource_group_name, resource_provider_namespace, parent_resource_path, resource_type, resource_name, subscription_id		Gets all permissions the caller has for a resource.
list_for_resource_group	select	resource_group_name, subscription_id		Gets all permissions the caller has for a resource group.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
parent_resource_path	string	The parent resource identity. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
resource_name	string	The name of the resource to get the permissions for. Required.
resource_provider_namespace	string	The namespace of the resource provider. Required.
resource_type	string	The resource type of the resource. Required.
subscription_id	string

SELECT examples

list_for_resource

Gets all permissions the caller has for a resource.

SELECT
actions,
condition,
conditionVersion,
dataActions,
notActions,
notDataActions
FROM azure.authorization.permissions
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND resource_provider_namespace = '{{ resource_provider_namespace }}' -- required
AND parent_resource_path = '{{ parent_resource_path }}' -- required
AND resource_type = '{{ resource_type }}' -- required
AND resource_name = '{{ resource_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_for_resource_group

Gets all permissions the caller has for a resource group.

SELECT
actions,
condition,
conditionVersion,
dataActions,
notActions,
notDataActions
FROM azure.authorization.permissions
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;