Skip to content

Instantly share code, notes, and snippets.

@chenbojian
Last active November 26, 2020 11:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save chenbojian/d5905a86af5f91d301c3c6f5438cc7df to your computer and use it in GitHub Desktop.
Save chenbojian/d5905a86af5f91d301c3c6f5438cc7df to your computer and use it in GitHub Desktop.
$roleAssignments = Get-AzRoleAssignment
$roles = Get-AzRoleDefinition
# https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
$storageActionRegexList = @('^\*$', '^\*/.+$', '^Microsoft\.Storage/.+$')
$storageDataActionRegexList = @('^\*$', '^\*/.+$', '^Microsoft\.Storage/.+$')
$storageManagementAccessRoles = @()
$storageDataAccessRoles = @()
foreach ($role in $roles) {
foreach ($action in $role.Actions) {
foreach ($regex in $storageActionRegexList) {
if ($action -match $regex) {
foreach ($roleAssignment in ($roleAssignments | Where-Object RoleDefinitionName -eq $role.Name)) {
$storageManagementAccessRoles += [PSCustomObject]@{
Name = $roleAssignment.DisplayName
ObjectType = $roleAssignment.ObjectType
RoleName = $role.Name
Action = $action
Scopes = $role.AssignableScopes -join ';'
}
}
}
}
}
foreach ($action in $role.DataActions) {
foreach ($regex in $storageDataActionRegexList) {
if ($action -match $regex) {
foreach ($roleAssignment in ($roleAssignments | Where-Object RoleDefinitionName -eq $role.Name)) {
$storageDataAccessRoles += [PSCustomObject]@{
Name = $roleAssignment.DisplayName
ObjectType = $roleAssignment.ObjectType
RoleName = $role.Name
Action = $action
Scopes = $role.AssignableScopes -join ';'
}
}
}
}
}
}
Write-Host -ForegroundColor Green "Storage Management Access List:"
$storageManagementAccessRoles | Format-Table
Write-Host -ForegroundColor Green "Storage Data Access List:"
$storageDataAccessRoles | Format-Table
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment