azure-role-selector
Finds and applies minimal Azure RBAC roles. Prevents over-privileged access with automated configuration.
Install
mkdir -p .claude/skills/azure-role-selector-tyler-r-kendrick && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/10039" && unzip -o skill.zip -d .claude/skills/azure-role-selector-tyler-r-kendrick && rm skill.zipInstalls to .claude/skills/azure-role-selector-tyler-r-kendrick
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Helps users find the right Azure RBAC role for an identity with least privilege access, then generate CLI commands and Bicep code to assign it. USE FOR: "what role should I assign", "least privilege role", "RBAC role for", "role to read blobs", "role for managed identity", "custom role definition", "assign role to identity". DO NOT USE FOR: creating managed identities (use azure-security), general security hardening (use azure-security-hardening), networking permissions (use azure-networking).Key capabilities
- →Determine RBAC roles
- →Generate CLI commands
- →Create Bicep templates
- →Assign least privilege roles
- →Validate role definitions
How it works
It identifies the minimal role definition matching desired permissions and generates the corresponding CLI and Bicep code.
Inputs & outputs
When to use azure-role-selector
- →Assigning least privilege roles
- →Generating RBAC CLI commands
- →Creating Bicep for role assignment
About this skill
Use the 'azure__documentation' tool to find the minimal role definition that matches the desired permissions the user wants to assign to an identity. If no built-in role matches the desired permissions, use the 'azure__extension_cli_generate' tool to create a custom role definition with the desired permissions. Then use the 'azure__extension_cli_generate' tool to generate the CLI commands needed to assign that role to the identity. Finally, use the 'azure__bicepschema' and 'azure__get_azure_bestpractices' tools to provide a Bicep code snippet for adding the role assignment.
When not to use it
- →Creating managed identities
- →General security hardening
Prerequisites
Limitations
- →Not for creating managed identities
How it compares
It focuses specifically on least-privilege RBAC role selection rather than general security.
Compared to similar skills
azure-role-selector side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| azure-role-selector (this skill) | 0 | 6mo | No flags | Intermediate |
| azure-private-link | 0 | 1mo | No flags | Intermediate |
| azure-firewall | 0 | 2mo | No flags | Intermediate |
| azure-infra-review | 0 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Tyler-R-Kendrick
View all by Tyler-R-Kendrick →You might also like
azure-private-link
vinodrex
Expert knowledge for Azure Private Link development including best practices, decision making, architecture & design patterns, limits & quotas, security, and configuration. Use when configuring Private Endpoints, DNS zones, SNAT bypass, Network Security Perimeters, or Azure Private Resolver, and oth
azure-firewall
MaRekGroup
Expert knowledge for Azure Firewall development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring DNAT/SNAT rules, TLS inspection, DNS proxy, hub-a
azure-infra-review
aldelar
Reviews Bicep modules, azure.yaml, and infrastructure changes for the KB Agent project. Checks naming, RBAC, module wiring, and doc sync. Use when working on infra/ or reviewing infrastructure PRs.
cloud-architect
sickn33
Expert cloud architect specializing in AWS/Azure/GCP multi-cloud infrastructure design, advanced IaC (Terraform/OpenTofu/CDK), FinOps cost optimization, and modern architectural patterns. Masters serverless, microservices, security, compliance, and disaster recovery. Use PROACTIVELY for cloud architecture, cost optimization, migration planning, or multi-cloud strategies.
azure-deployment-preflight
github
Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.
cloud-penetration-testing
davila7
This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.