Permissions to execute Providers_ProviderPermissions unclear

[tyson-trust]

For the Providers_ProviderPermissions API, the permissions to successfully execute this are unclear.

For example if I want to run this against the Microsoft.Compute service if I assign the role executing the API the permission of Microsoft.Compute/*/read then it will run sucessfully however if I instead grant it every Microsoft.Compute read operation as returned from a az provider operation show --namespace Microsoft.Compute azure cli query then I get the following error returned by the API:

{
    "error": {
        "code": "MultipleErrorsOccurred",
        "message": "Multiple error occurred: BadGateway,BadGateway,BadGateway,BadGateway,BadGateway,BadGateway,BadGateway,BadGateway,BadGateway. Please see details.",
        "details": [
            {
                "code": "BadGateway",
                "message": "Response from service 'Microsoft.Compute' does not contain sufficient information to enforce access control policy."
            },
            {
                "code": "BadGateway",
                "message": "Response from service 'Microsoft.Compute' does not contain sufficient information to enforce access control policy."
            },
.....

I'm using Microsoft.Compute as an example here if I try other services such as Microsoft.Storage etc. I get the same result.

This implies either there is a undocumented permission I need to have or the API is not working correctly.

[SaurabhSharma-MSFT]

@tyson-trust What kind of permissions you have on the subscription. Please try with the RBAC "Reader" permissions if you are only getting the provider permissions. I have tested REST endpoint works as expected -

Thanks.

[tyson-trust]

I know the reader role will work for this as it allows */read but I'm trying to apply the permission of least privilege with my API calls, and the tightest I can currently get is to add `/*/read' to Actions and then manually list every operation in the notActions field eg

"permissions": [
            {
                "actions": [
                    "Microsoft.Compute/*/read"
                ],
                "notActions": [
                    "Microsoft.Compute/availabilitySets/read",
                    "Microsoft.Compute/availabilitySets/vmSizes/read",
                    "Microsoft.Compute/capacityReservationGroups/capacityReservations/read",
                    "Microsoft.Compute/capacityReservationGroups/read",
                    "Microsoft.Compute/cloudServices/instanceView/read",
                     ....

and the call still works but this isn't exactly scalable for me and it implies that there is some other unpublished read permission in the service that it's looking for.