Self-hosted alternatives to azure-role-selector

A

azure-role-selector

Guidance for selecting least-privilege Azure roles matching specific permission

azure-role-selector is an agent skill from the github/awesome-copilot collection that helps choose the least-privilege Azure role for an identity. Given the permissions someone needs, it searches Azure's built-in roles for the smallest role that matches them. If no built-in role fits, it generates a custom role definition with exactly the permissions required. It then produces the CLI commands that assign the role to the identity, and a Bicep snippet that adds the same role assignment to infrastructure code. The principle is least privilege: an identity should be given the narrowest access that lets it do its job, which limits the damage if its credentials are misused. The skill uses Azure's documentation and tooling to find the role and generate the commands and code, so the answer reflects the current role catalog. It is useful when setting up a service identity, a pipeline or a team member's access, where a broad built-in role such as Owner or Contributor is often chosen by habit. Role assignments grant real access, so the commands should be reviewed before they are run, and they should be run by someone with the authority to grant the role. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 9.4K installs and passing results from three security audits at the time of the scan.