review used security roles

[iricigor]

Currently, we sometimes use azure security roles which give more permissions than really required. For example, Storage Contributor has rights to read and delete other data, which is not required.

One possible option is to create and use Azure custom roles

[iricigor]

Here is one example, not sure though on blobServices actions

{
    "properties": {
        "roleName": "Storage Blob Data Sender",
        "description": "Can only send new data to storage blob, cannot read or delete anything.",
        "assignableScopes": [
            "/subscriptions/6558e738-8188-4771-a5fb-b62f974f971c/resourceGroups/AzmiEnvironment"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
                ],
                "notActions": [],
                "dataActions": [
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
                ],
                "notDataActions": []
            }
        ]
    }
}