What does the Azure Contributor role allow a CloudGuard HA cluster to do on a NSG?

[Arend]

Hi,

In the manual at step 1. you are being notified that the new HA cluster you deploy needs a contributor role on the existing NSG.

Our customer is wondering what risks are involved in allowing this contributor role onto the existing NSG.

Otherwise said, what functions (risks) are involved?

CloudGuard Network for Azure High Availability Cluster Deployment Guide

Workflow for Setting Up a High Availability Cluster in Azure:

Step 1: Deploy with a Template in Azure

If you select an existing NSG from a different Resource Group, create roleAssignment on the NSG with contributor permissions for the Cluster’s managed identity.

[Edan_Leventhal · Accepted solution]

Hi Arned,

The contributor role is required for a cluster in order to move the VIP of the cluster between members during a failover.

As for the risks involved, at the end of the day you are giving the cluster members the following permissions:
"Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries"
(Azure built-in roles - Azure RBAC | Microsoft Learn)

Hope this is the information you needed.

Edan