# (Azure) Access Control (IAM) Policy Management

## **Access Control** Policy

**SpaceONE** highly recommends to set appropriate permissions to Resource groups for each purpose.&#x20;

Please, Set service account, To Create API for each use case:

* [General Collector](#general-collector)

## General Collector&#x20;

Collector requires appropriate authorities to collect cloud resources. We strongly recommend to limit collector's service account its permission to **read only access**.&#x20;

Otherwise, you can add more restrictions per resource groups or actions. One of the useful example is to restrict its rights within resource groups.



**Prerequisite**

This user guide tutorial assumes that a `subscription id` is already created.

There are two options for giving permission to Azure resources which SpaceONE is going to collect.

* Grant `Reader role` to **resource group** where resources are located. If you give a role to resource group, _SpaceONE_ can only collect resources located in this resource group.
* Grant `Reader role` to **subscription** where resources are located. If you give a role to the subscription, SpaceONE can collect resources in all resource groups in this subscription.

If you want to know more about Azure's access control policies, visit the link below.

[https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal](https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)

**Grant Roles to resource groups**

**STEP 1. Log in Azure Portal > Resource groups**&#x20;

Select the resource group for which the collector will collect resources.

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWhFgRLwfJTdT16keGz%2F-MWhFpBT8O3ZmmfgNvXB%2Fimage.png?alt=media\&token=73392889-3459-4a12-ab8f-3a04e9ae2be2)

**STEP 2. Click `Access control (IAM)` Navigation tab, and click `+Add` button.**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWhFgRLwfJTdT16keGz%2F-MWhFvQL9CSvPy4hgdO4%2Fimage.png?alt=media\&token=2fd94287-d3ff-47cc-aeef-d969ff90ea97)



**STEP 3: Assign the `Reader role`  to the account. The account should  have an access permission in this resource group.**



![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWhFgRLwfJTdT16keGz%2F-MWhG-Cvdp3i9gnQwO4q%2Fimage.png?alt=media\&token=cf995f73-ac5b-4dc4-88dd-450a22202b58)

## Troubleshooting

### Authorization

Please, follow the steps on troubleshooting guide below if you face any of error messages above.

#### 1. (AuthorizationFailed) Client does not have authorization&#x20;

{% hint style="warning" %}
The client `client_id` with object id `object_id` does not have authorization to perform action Microsoft.Resources/subscriptions/resourcegroups/read over scope `subscription_id` or the scope is invalid. If access was recently granted, please refresh your credentials
{% endhint %}

**STEP 1: Log in Azure Portal and Drive to > Subscriptions**&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYJxLbgy5XHFoH0x__P%2F-MYJxioS28WjNQ2o9Lqb%2FScreen%20Shot%202021-04-15%20at%2018.55.14.png?alt=media\&token=a4f0c0d0-4e1f-4670-96f9-2f6387f5a458)

\
**STEP 2: Click the subscription name where resources are located.**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYNORFRux1zDLAqdPDG%2F-MYNPMp_XQadfUUP1nV3%2Fimage.png?alt=media\&token=650d8365-01a5-4ad1-886b-1a273ba93a71)

**STEP 3: Click `+Add role assignment` button.**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYJxLbgy5XHFoH0x__P%2F-MYJzyJkq_7vre98DJ02%2Fimage%20\(2\).png?alt=media\&token=3ebb8f75-5547-4ea3-9037-e895d51fbbf0)



**STEP 4: Add role assignment for followings as below**

* **Role**
  * `Reader`
* **Assign access to**
  * `User, group, or service principal`
* **Select**
  *   `App that has registered on Active directory` **at > Azure ActiveDirectory > Registered App**\


      <img src="https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYNkDuZ5Bvjd7mTlii0%2F-MYNmfNLdRDBxKqROpCt%2FScreen%20Shot%202021-04-16%20at%2012.45.27.png?alt=media&#x26;token=e1fd9479-647a-4a58-8cc1-2b7cc1262ada" alt="" data-size="original">

{% hint style="info" %}
**Note:**  Service Account name and Registered App name may be confused. \
Please, Select Registered App as below (Different Icons).\

{% endhint %}

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYNkDuZ5Bvjd7mTlii0%2F-MYNlDc2Q2jFf-xBotod%2FScreen%20Shot%202021-04-16%20at%2012.38.16.png?alt=media\&token=64cae088-8857-4350-a905-aaea94e1a0b8)
