Figure out the right set of actions in Azure RBAC custom role

Question

There is this Azure function that needs to call Azure REST API.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/config/web?api-version=2019-08-01

And the function should have the least possible permissions. I have a custom role (cloned from subscription level contributor), assigned to the function at the subscription level. The JSON is below:

{
    "properties": {
        "roleName": "Web config contributor",
        "description": "Custom role that can read resources under subscription and update their web config.",
        "assignableScopes": [
            "/subscriptions/def-abc-45346-9477-xyz"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read",
                    "Microsoft.Web/*"
                ],
                "notActions": [
                    "Microsoft.Authorization/*/Delete",
                    "Microsoft.Authorization/*/Write",
                    "Microsoft.Authorization/elevateAccess/Action",
                    "Microsoft.Blueprint/blueprintAssignments/write",
                    "Microsoft.Blueprint/blueprintAssignments/delete"
                ],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

The only point it seems to work is if the actions is set to *. Else it throws 403 (Forbidden). I have tried:

"Actions": [
    "*/read",
    "Microsoft.Web/sites/config/Write",
    "Microsoft.web/sites/config/delete"
  ]

"Actions": [
    "*/read",
    "Microsoft.Web/sites/*"
  ]

"Actions": [
    "*/read",
    "Microsoft.Web/*"
  ]

What is the way to figure out what actions are to be allowed on the custom role for the REST operation to work?

Answer 1

Based on my test, Microsoft.Web/sites/config/Write is enough.

My custom role for your reference.

{
    "properties": {
        "roleName": "testrole005",
        "description": "",
        "assignableScopes": [
            "/subscriptions/e5b0fcfa-e859-43f3-8d84-5xxxx29fxxxx"
        ],
        "permissions": [
            {
                "actions": [    
                    "*/read",
                    "Microsoft.Web/sites/config/Write"
                    ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}