azure-role-selector
Guidance for selecting least-privilege Azure roles matching specific permission
by githubFree
Description
azure-role-selector is an agent skill from the github/awesome-copilot collection that helps choose the least-privilege Azure role for an identity. Given the permissions someone needs, it searches Azure's built-in roles for the smallest role that matches them. If no built-in role fits, it generates a custom role definition with exactly the permissions required. It then produces the CLI commands that assign the role to the identity, and a Bicep snippet that adds the same role assignment to infrastructure code. The principle is least privilege: an identity should be given the narrowest access that lets it do its job, which limits the damage if its credentials are misused. The skill uses Azure's documentation and tooling to find the role and generate the commands and code, so the answer reflects the current role catalog. It is useful when setting up a service identity, a pipeline or a team member's access, where a broad built-in role such as Owner or Contributor is often chosen by habit. Role assignments grant real access, so the commands should be reviewed before they are run, and they should be run by someone with the authority to grant the role. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 9.4K installs and passing results from three security audits at the time of the scan.…
Highlights
- Finds the smallest built-in role that fits
- Generates custom role definitions when needed
- CLI commands for role assignment
- Bicep snippet for infrastructure code
- Least-privilege principle
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate azure-role-selector.
People also visit
azure-role-selector FAQ
What does it recommend?
The smallest built-in Azure role that matches the permissions needed, or a custom role if none fits.
What does it produce?
CLI commands to assign the role and a Bicep snippet for the same assignment.
Why least privilege?
An identity with only the access it needs limits the damage if its credentials are misused.
Should I run the commands as written?
Review them first, since role assignments grant real access, and run them with the right authority.
How do I install it?
Run npx skills add https://github.com/github/awesome-copilot --skill azure-role-selector.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best azure-role-selector alternatives?
Popular alternatives to azure-role-selector include azure-validate, azure-cost-optimization and attack-tree-construction. See all azure-role-selector alternatives