Join Log in
Score:0
avatar Server

Which service principal role will provide the minimum permissions necessary to automate installation of a website certificate?

jo flag
InteXX

I wish to grant a third-party application API access to my Azure tenant for purposes of installing a TLS certificate on a certain website ("App Service," in Azure terminology).

However, assigning the Contributor role seems a bit excessive. I don't want to give away the keys to the kingdom, so to speak.

Is there a lesser role that I can use that will accomplish this goal? I'd like to apply the Principle of Least Privilege here.

-- EDIT --

- Desired end state

A security role configuration that permits the third-party application to upload and install a TLS certificate on an App Service, but nothing more.

- The specific problem

The Contributor role grants near-system-wide permissions within the tenant, permissions that the application doesn't need (and therefore shouldn't have).

- Information about the environment

The application is connecting to Azure via either the REST API or the .NET SDK, and thus requires the Service Principal's ID and Client Secret, as well as the Tenant ID.

- Attempted solutions

I've examined the official documentation in search of a role specific to the purpose—limited to configuring an App Service—but I've not found one. By posting here I'm hoping to find someone with direct experience with the same scenario (a pretty common one, I would imagine), and who has solved it to his satisfaction.

59
0 + 3
djdomi avatar
za flag
djdomi
Questions seeking installation, configuration or diagnostic help must include the desired end state, the specific problem or error, sufficient information about the configuration and environment to reproduce it, and attempted solutions. Questions without a clear problem statement that not include the even told steps, are not useful to other readers and are unlikely to get good answers
0
Reply
jo flag
InteXX
Thanks for the pointers. I thought I was already there, but I'll give it another shot. Edits forthcoming.
0
Reply
jo flag
InteXX
OK, I've added some improvements. Thanks again. Note that I shouldn't have to explain everything down to the smallest detail—some foreknowledge is necessary to understand the question at all (e.g. what is Azure, what is a Service Principal, what is a Role in the context of Azure, how does one assign a Role, etc.).
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.