From 0dfb1cc9d0c2da9a667e2cacb4bba660d4009152 Mon Sep 17 00:00:00 2001
From: sbeskin <sbeskin@redhat.com>
Date: Fri, 19 Aug 2022 09:49:57 +0200
Subject: [PATCH] OADP_419_minimum_permissions_for_storage_location_providers

---
 modules/migration-configuring-aws-s3.adoc |  2 +-
 modules/migration-configuring-azure.adoc  | 23 +++++++++++++++++++++++
 modules/migration-configuring-gcp.adoc    |  2 +-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/modules/migration-configuring-aws-s3.adoc b/modules/migration-configuring-aws-s3.adoc
index 0fd71377d237..e6475d03a955 100644
--- a/modules/migration-configuring-aws-s3.adoc
+++ b/modules/migration-configuring-aws-s3.adoc
@@ -111,7 +111,7 @@ $ cat > velero-policy.json <<EOF
 EOF
 ----
 
-. Attach the policies to give the `velero` user the necessary permissions:
+. Attach the policies to give the `velero` user the minimum necessary permissions:
 +
 [source,terminal]
 ----
diff --git a/modules/migration-configuring-azure.adoc b/modules/migration-configuring-azure.adoc
index eaaee2bad626..4d796c263a85 100644
--- a/modules/migration-configuring-azure.adoc
+++ b/modules/migration-configuring-azure.adoc
@@ -127,6 +127,29 @@ $ AZURE_STORAGE_ACCOUNT_ACCESS_KEY=`az storage account keys list \
   --query "[?keyName == 'key1'].value" -o tsv`
 ----
 
+. Create a custom role that has the minimum required permissions:
++
+[source,terminal,subs="attributes+"]
+----
+AZURE_ROLE=Velero
+az role definition create --role-definition '{
+   "Name": "'$AZURE_ROLE'",
+   "Description": "Velero related permissions to perform backups, restores and deletions",
+   "Actions": [
+       "Microsoft.Compute/disks/read",
+       "Microsoft.Compute/disks/write",
+       "Microsoft.Compute/disks/endGetAccess/action",
+       "Microsoft.Compute/disks/beginGetAccess/action",
+       "Microsoft.Compute/snapshots/read",
+       "Microsoft.Compute/snapshots/write",
+       "Microsoft.Compute/snapshots/delete",
+       "Microsoft.Storage/storageAccounts/listkeys/action",
+       "Microsoft.Storage/storageAccounts/regeneratekey/action"
+   ],
+   "AssignableScopes": ["/subscriptions/'$AZURE_SUBSCRIPTION_ID'"]
+   }'
+----
+
 . Create a `credentials-velero` file:
 +
 [source,terminal,subs="attributes+"]
diff --git a/modules/migration-configuring-gcp.adoc b/modules/migration-configuring-gcp.adoc
index cb7690168f91..6890fc14b4fe 100644
--- a/modules/migration-configuring-gcp.adoc
+++ b/modules/migration-configuring-gcp.adoc
@@ -82,7 +82,7 @@ $ SERVICE_ACCOUNT_EMAIL=$(gcloud iam service-accounts list \
     --format 'value(email)')
 ----
 
-. Attach the policies to give the `velero` user the necessary permissions:
+. Attach the policies to give the `velero` user the minimum necessary permissions:
 +
 [source,terminal]
 ----