Custom IAM Roles

Concept

Custom roles define exactly which permissions a principal gets, avoiding overly broad predefined roles (Editor/Contributor = 3,000+ permissions).

Definition Format

JSON (Actions/NotActions)

JSON (Allow/Deny statements)

YAML or CLI permission list

Scope

Management Group / Subscription

Account (managed policy)

Organization / Project

Limit

5,000 roles per Entra tenant

1,500 managed policies / account

300 per org + 300 per project

Max Permissions

~2,000 per role (perf)

Policy doc max 6,144 chars

3,000 per custom role

Create a Custom Role

○ Azure — JSON Definition

az role definition create --role-definition '{"Name":"StorageReader","Actions":["Microsoft.Storage/storageAccounts/read","Microsoft.Storage/storageAccounts/blobServices/containers/read"],"AssignableScopes":["/subscriptions/SUB_ID"]}'

○ AWS — IAM Policy JSON

aws iam create-policy --policy-name StorageReader --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::prod-bucket/*"]}]}'

○ GCP — gcloud CLI

gcloud iam roles create custom_storage_reader --organization=ORG_ID --stage=GA --title="Custom Storage Reader" --permissions="storage.objects.get,storage.objects.list,storage.buckets.get"

Stage	Azure	AWS	GCP
Alpha	N/A	N/A	Disabled — not usable
Testing/Beta	N/A	N/A	Testing only — warnings
GA	Available	Available	Production-ready
Deprecated	Stays usable	Can be detached	DEPRECATED with replacement
Deleted	Removed	Policy detached	30-day undelete window

Stage

Azure

AWS

GCP

Alpha

N/A

Disabled — not usable

Testing/Beta

N/A

Testing only — warnings

Available

Production-ready

Deprecated

Stays usable

Can be detached

DEPRECATED with replacement

Deleted

Removed

Policy detached

30-day undelete window

Concept

Create a Custom Role

○ Azure — JSON Definition

○ AWS — IAM Policy JSON

○ GCP — gcloud CLI

Lifecycle Stages