- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- Cloud Network Security
- :
- Discussion
- :
- What does the Azure Contributor role allow a Cloud...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What does the Azure Contributor role allow a CloudGuard HA cluster to do on a NSG?
Hi,
In the manual at step 1. you are being notified that the new HA cluster you deploy needs a contributor role on the existing NSG.
Our customer is wondering what risks are involved in allowing this contributor role onto the existing NSG.
Otherwise said, what functions (risks) are involved?
CloudGuard Network for Azure High Availability Cluster Deployment Guide
Workflow for Setting Up a High Availability Cluster in Azure:
Step 1: Deploy with a Template in Azure
If you select an existing NSG from a different Resource Group, create roleAssignment on the NSG with contributor permissions for the Cluster’s managed identity.
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Arned,
The contributor role is required for a cluster in order to move the VIP of the cluster between members during a failover.
As for the risks involved, at the end of the day you are giving the cluster members the following permissions:
"Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries"
(Azure built-in roles - Azure RBAC | Microsoft Learn)
Hope this is the information you needed.
Edan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Arned,
The contributor role is required for a cluster in order to move the VIP of the cluster between members during a failover.
As for the risks involved, at the end of the day you are giving the cluster members the following permissions:
"Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries"
(Azure built-in roles - Azure RBAC | Microsoft Learn)
Hope this is the information you needed.
Edan