Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Arend
Contributor
Jump to solution

What does the Azure Contributor role allow a CloudGuard HA cluster to do on a NSG?

Hi,

In the manual at step 1. you are being notified that the new HA cluster you deploy needs a contributor role on the existing NSG.

Our customer is wondering what risks are involved in allowing this contributor role onto the existing NSG.

Otherwise said, what functions (risks) are involved?

CloudGuard Network for Azure High Availability Cluster Deployment Guide

Workflow for Setting Up a High Availability Cluster in Azure:

Step 1: Deploy with a Template in Azure

If you select an existing NSG from a different Resource Group, create roleAssignment on the NSG with contributor permissions for the Cluster’s managed identity.

0 Kudos
1 Solution

Accepted Solutions
Edan_Leventhal
Employee
Employee

Hi Arned,

The contributor role is required for a cluster in order to move the VIP of the cluster between members during a failover.

As for the risks involved, at the end of the day you are giving the cluster members the following permissions:
"Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries"
(Azure built-in roles - Azure RBAC | Microsoft Learn)

Hope this is the information you needed.

Edan

View solution in original post

0 Kudos
1 Reply
Edan_Leventhal
Employee
Employee

Hi Arned,

The contributor role is required for a cluster in order to move the VIP of the cluster between members during a failover.

As for the risks involved, at the end of the day you are giving the cluster members the following permissions:
"Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries"
(Azure built-in roles - Azure RBAC | Microsoft Learn)

Hope this is the information you needed.

Edan

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.