Agent IAM Policies in Azure
When you run rpk cloud byoc azure apply to create a BYOC cluster, you grant these permissions to the Redpanda Cloud agent. The agent uses them to call the Azure API and manage cluster resources on your behalf. The permissions follow the principle of least privilege. They are not required by Redpanda Cloud end users.
|
This page covers the permissions Redpanda needs to create BYOC clusters. It does not apply to BYOVNet clusters. |
|
Azure RBAC for the agent is scoped to the cluster resource groups, for example |
How to read this page
The agent’s permissions are granted through a single custom role definition. The role’s actions are organized into functional groups (compute, networking, storage, identity, monitoring, resource group, and data-plane actions). Each group lists the actions it allows and why they are needed. The full role definition appears in a collapsible Terraform block at the end of this page.
| Access level | Meaning |
|---|---|
Read |
|
Write |
|
Delete |
|
Compute and Kubernetes
Manages the AKS managed clusters and their agent (node) pools that run the Redpanda data plane.
| Permission | Access | Why it is needed |
|---|---|---|
|
Delete |
Required to remove AKS node pools when scaling down or decommissioning your Redpanda cluster. |
|
Read |
Needed so Redpanda Cloud can inspect the state of the AKS node pools that host your Redpanda brokers. |
|
Write |
Required to apply node image upgrades so the underlying OS running your Redpanda brokers stays patched and secure. |
|
Read |
Required to inspect supported upgrade paths before upgrading the AKS node pools that host your Redpanda cluster. |
|
Write |
Required to provision and scale the AKS node pools that run your Redpanda brokers and supporting workloads. |
|
Delete |
Required to tear down the AKS cluster that hosts Redpanda when you decommission your environment. |
|
Write |
Required to retrieve admin credentials for the AKS cluster that hosts your Redpanda deployment. |
|
Write |
Required so Redpanda Cloud can obtain kubeconfig credentials to operate and manage the AKS cluster running your Redpanda deployment. |
|
Read |
Needed so Redpanda Cloud can read the configuration and status of the AKS cluster hosting your Redpanda deployment. |
|
Read |
Required to inspect supported Kubernetes upgrade paths before upgrading the AKS cluster that hosts Redpanda. |
|
Write |
Required to create and update the AKS cluster that hosts your managed Redpanda deployment. |
Networking and connectivity
Joins the cluster to the virtual network and subnets, manages public and private DNS zones and private endpoints, reads Private Link services, and manages public IP addresses.
| Permission | Access | Why it is needed |
|---|---|---|
|
Read |
Required to read DNS zone SOA records when reconciling the DNS configuration that exposes your Redpanda cluster endpoints. |
|
Delete |
Required to delete the public DNS zone used for your Redpanda cluster endpoints when the cluster is decommissioned. |
|
Read |
Needed so Redpanda Cloud can look up the DNS zone used to publish endpoints for your Redpanda cluster. |
|
Write |
Required to create or update the public DNS zone used for your Redpanda cluster endpoints. |
|
Delete |
Required to remove private DNS A records when cluster endpoints are reconfigured or decommissioned. |
|
Read |
Required to inspect the private DNS A records that map cluster service names to private endpoint addresses. |
|
Write |
Required to create or update private DNS A records so cluster service names resolve to the correct private endpoint addresses. |
|
Read |
Required to inspect the authoritative settings of the private DNS zone used for cluster endpoints. |
|
Write |
Required to update the authoritative settings of the private DNS zone used for cluster endpoints. |
|
Delete |
Required to remove a private DNS zone created for cluster endpoints when it is no longer needed. |
|
Write |
Required to allow cluster networking resources to associate with the private DNS zone used for endpoint resolution. |
|
Read |
Required to inspect the private DNS zone used to resolve cluster endpoints. |
|
Delete |
Required to remove the link between a private DNS zone and a virtual network during reconfiguration or cleanup. |
|
Read |
Required to inspect the virtual network links that make the cluster’s private DNS zone resolvable from connected VNets. |
|
Write |
Required to create or update links that make the cluster’s private DNS zone resolvable from connected VNets. |
|
Write |
Required to create or update the private DNS zone that contains records for cluster endpoints. |
|
Delete |
Required to remove private endpoints when private connectivity is disabled or the cluster is decommissioned. |
|
Delete |
Required to remove the association between a private endpoint and its private DNS zones during reconfiguration or cleanup. |
|
Read |
Required to inspect the private DNS zone groups associated with cluster private endpoints. |
|
Write |
Required to associate cluster private endpoints with the private DNS zones used for name resolution. |
|
Read |
Required to inspect the state and configuration of private endpoints used by your cluster. |
|
Write |
Required to create or update private endpoints that provide private access to cluster resources. |
|
Read |
Needed so Redpanda Cloud can inspect Private Link services used to expose your Redpanda cluster privately to your VNets. |
|
Delete |
Required to release public IP addresses when networking resources for your Redpanda cluster are decommissioned. |
|
Read |
Needed so Redpanda Cloud can inspect the public IP addresses associated with your cluster’s ingress endpoints. |
|
Write |
Required to allocate the public IP addresses used for the ingress endpoints of your Redpanda cluster (when public access is enabled). |
|
Write |
Required to associate your cluster’s public IP addresses with a public IP prefix. |
|
Write |
Required to attach your cluster’s networking resources to the virtual network. |
|
Read |
Needed so Redpanda Cloud can inspect the virtual network in which your Redpanda cluster is deployed. |
|
Delete |
Required to remove subnets provisioned for your Redpanda cluster when it is decommissioned. |
|
Write |
Required so AKS nodes, load balancers, and private endpoints for your Redpanda cluster can attach to the designated subnets. |
|
Read |
Needed so Redpanda Cloud can inspect the subnets used by your Redpanda cluster. |
|
Write |
Required to create and configure the subnets that host the AKS nodes and networking resources for your Redpanda cluster. |
Storage
Manages the storage accounts and blob containers backing Tiered Storage, and reads the Key Vault.
| Permission | Access | Why it is needed |
|---|---|---|
|
Read |
Needed so Redpanda Cloud can read the properties of the Key Vault associated with your cluster. This permission does not grant access to keys or secret values. |
|
Write |
Required to approve private endpoint connections to the storage account that backs your cluster. |
|
Delete |
Required to remove the blob container used for Tiered Storage when the associated Redpanda cluster is decommissioned. |
|
Read |
Needed so Redpanda Cloud can inspect the blob container that backs Tiered Storage for your cluster. |
|
Write |
Required to create and configure the blob container used for Tiered Storage of your Redpanda topic data. |
|
Write |
Required to obtain a short-lived user delegation key for scoped, time-bound access to the blobs that back your Redpanda cluster. |
|
Read |
Needed so Redpanda Cloud can inspect the blob service configuration on the storage account backing your cluster. |
|
Write |
Required to configure blob service settings (such as retention and versioning) on the storage account that backs Tiered Storage. |
|
Delete |
Required to remove the storage account provisioned for your Redpanda cluster when it is decommissioned. |
|
Read |
Required to read file service metadata on the storage account so Redpanda Cloud can reconcile its full configuration. |
|
Read |
Required to read file share metadata on the storage account so Redpanda Cloud can reconcile its full configuration. |
|
Write |
Required to retrieve storage account keys used for authenticated access to the storage account backing your Redpanda cluster. |
|
Read |
Required to read queue service metadata on the storage account so Redpanda Cloud can reconcile its full configuration. |
|
Read |
Needed so Redpanda Cloud can inspect the storage account used for Tiered Storage of your Redpanda topic data. |
|
Write |
Required to create and configure the storage account that backs Tiered Storage for your Redpanda cluster. |
Identity and access
Manages the role assignments, role definitions, and user-assigned managed identities (including federated credentials) the cluster components need.
| Permission | Access | Why it is needed |
|---|---|---|
|
Delete |
Required to remove role assignments when tearing down or reconfiguring identities used by your Redpanda cluster. |
|
Read |
Needed so Redpanda Cloud can verify the correct role assignments are in place for the managed identities powering your cluster. |
|
Write |
Required to grant the managed identities used by your Redpanda cluster the specific roles they need on your Azure resources. |
|
Delete |
Required to remove the least-privilege custom role definitions Redpanda creates when your cluster is decommissioned. |
|
Read |
Needed so Redpanda Cloud can inspect existing custom role definitions before managing identities and permissions in your subscription. |
|
Write |
Required to create and update the scoped custom role definitions that give Redpanda workloads only the permissions they need. |
|
Write |
Required to attach user-assigned managed identities to the AKS and storage resources that make up your Redpanda cluster. |
|
Delete |
Required to remove user-assigned managed identities when your Redpanda cluster is decommissioned. |
|
Delete |
Required to remove federated identity credentials when Redpanda workloads are torn down or reconfigured. |
|
Read |
Needed so Redpanda Cloud can verify the federated identity credentials that let Redpanda workloads authenticate to Azure without static secrets. |
|
Write |
Required to create federated identity credentials so Redpanda workloads running in AKS can authenticate to Azure services securely via workload identity, without long-lived secrets. |
|
Read |
Needed so Redpanda Cloud can inspect the user-assigned managed identities used by your cluster. |
|
Write |
Required to create and update the user-assigned managed identities that Redpanda workloads use to access Azure resources on your behalf. |
Monitoring
Reads Log Analytics workspace keys used to reconcile node pools.
| Permission | Access | Why it is needed |
|---|---|---|
|
Read |
Required to retrieve the Log Analytics workspace keys used to connect cluster monitoring agents to the workspace. |
Resource group
Reads the resource groups the cluster is deployed into.
| Permission | Access | Why it is needed |
|---|---|---|
|
Read |
Needed so Redpanda Cloud can verify the target resource group exists and confirm it has the correct permissions before deploying your cluster. |
Data-plane actions
These data_actions let Redpanda read and write your topic data in the Tiered Storage blob containers.
| Permission | Access | Why it is needed |
|---|---|---|
|
Write |
Required so Redpanda can write topic data to the blob storage container used for Tiered Storage. (Data-plane action.) |
|
Delete |
Required so Redpanda can remove expired or compacted objects from the blob storage container used for Tiered Storage, according to your retention policies. (Data-plane action.) |
|
Write |
Required so Redpanda can reorganize objects in the Tiered Storage container as part of normal data lifecycle operations. (Data-plane action.) |
|
Read |
Required so Redpanda can read topic data stored in the Tiered Storage blob container when serving consumer reads. (Data-plane action.) |
|
Write |
Required so Redpanda can upload topic segments to the blob storage container that backs Tiered Storage for your cluster. (Data-plane action.) |
Full role definition
The complete set of actions and data_actions in the agent custom role:
Terraform
actions = [
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
"Microsoft.Network/dnszones/read",
"Microsoft.Network/dnszones/write",
"Microsoft.Network/dnszones/delete",
"Microsoft.Network/dnszones/SOA/read",
"Microsoft.Network/privatelinkservices/read",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.ContainerService/managedClusters/read",
"Microsoft.ContainerService/managedClusters/delete",
"Microsoft.ContainerService/managedClusters/write",
"Microsoft.ContainerService/managedClusters/upgradeProfiles/read",
"Microsoft.ContainerService/managedClusters/agentPools/read",
"Microsoft.ContainerService/managedClusters/agentPools/write",
"Microsoft.ContainerService/managedClusters/agentPools/delete",
"Microsoft.ContainerService/managedClusters/agentPools/upgradeNodeImageVersion/action",
"Microsoft.ContainerService/managedClusters/agentPools/upgradeProfiles/read",
"Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
"Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/read",
"Microsoft.Network/virtualNetworks/subnets/write",
"Microsoft.Network/virtualNetworks/subnets/delete",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete",
"Microsoft.Authorization/roleDefinitions/write",
"Microsoft.Authorization/roleDefinitions/read",
"Microsoft.Authorization/roleDefinitions/delete",
"Microsoft.ManagedIdentity/userAssignedIdentities/read",
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
"Microsoft.ManagedIdentity/userAssignedIdentities/delete",
"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Storage/storageAccounts/delete",
"Microsoft.Storage/storageAccounts/blobServices/read",
"Microsoft.Storage/storageAccounts/blobServices/write",
"Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
"Microsoft.Network/privateEndpoints/read",
"Microsoft.Network/privateEndpoints/write",
"Microsoft.Network/privateEndpoints/delete",
"Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
"Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
"Microsoft.Network/privateEndpoints/privateDnsZoneGroups/delete",
"Microsoft.Network/privateDnsZones/read",
"Microsoft.Network/privateDnsZones/write",
"Microsoft.Network/privateDnsZones/delete",
"Microsoft.Network/privateDnsZones/join/action",
"Microsoft.Network/privateDnsZones/SOA/read",
"Microsoft.Network/privateDnsZones/SOA/write",
"Microsoft.Network/privateDnsZones/A/read",
"Microsoft.Network/privateDnsZones/A/write",
"Microsoft.Network/privateDnsZones/A/delete",
"Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
"Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
"Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete",
"Microsoft.Network/virtualNetworks/join/action",
"Microsoft.Network/publicIPAddresses/read",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/publicIPPrefixes/join/action",
"Microsoft.Storage/storageAccounts/queueServices/read",
"Microsoft.Storage/storageAccounts/fileServices/read",
"Microsoft.Storage/storageAccounts/fileServices/shares/read",
"Microsoft.Storage/storageAccounts/listkeys/action",
"Microsoft.KeyVault/vaults/read",
"Microsoft.OperationalInsights/workspaces/sharedkeys/read",
]
data_actions = [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
]