Add a custom role for accessing batch account

deploy/infra/groups/orchestration.bicep

@@ -161,6 +161,14 @@ module uami '../modules/managed.identity.user.bicep' = {
   }
 }
 
+module batchAccountCustomRole '../modules/batch.account.custom.role.bicep' = {
+  name: '${namingPrefix}-batch-account-custom-role'
+  scope: subscription()
+  params: {
+    batchAccountName: toLower(batchAccountNameVar)
+  }
+}
+
 module batchAccount '../modules/batch.account.bicep' = {
   name: '${namingPrefix}-batch-account'
   params: {
@@ -175,6 +183,7 @@ module batchAccount '../modules/batch.account.bicep' = {
     poolAllocationMode: batchAccountPoolAllocationMode
     publicNetworkAccess: batchAccountPublicNetworkAccess
     keyVaultName: keyvaultNameVar
+    assignRoleToUserManagedIdentity: batchAccountCustomRole.outputs.batchAccountCustomRoleName
   }
   dependsOn: [
     uami

deploy/infra/modules/batch.account.bicep

@@ -103,11 +103,11 @@ var role = {
 }
 
 resource assignRole 'Microsoft.Authorization/roleAssignments@2020-10-01-preview' = {
-  name: guid(batchAccount.id, userManagedIdentityPrincipalId, role[toLower(assignRoleToUserManagedIdentity)])
+  name: guid(batchAccount.id, userManagedIdentityPrincipalId, assignRoleToUserManagedIdentity)
   scope: batchAccount
   properties: {
     principalId: userManagedIdentityPrincipalId
-    roleDefinitionId: role[toLower(assignRoleToUserManagedIdentity)]
+    roleDefinitionId: assignRoleToUserManagedIdentity
   }
 }
 

deploy/infra/modules/batch.account.custom.role.bicep

@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+targetScope = 'subscription'
+
+param batchAccountName string
+param allowedActions array = [
+  'Microsoft.Batch/batchAccounts/pools/write'
+  'Microsoft.Batch/batchAccounts/pools/read'
+  'Microsoft.Batch/batchAccounts/pools/delete'
+  'Microsoft.Batch/batchAccounts/read'
+  'Microsoft.Batch/batchAccounts/listKeys/action'
+]
+param allowedDataActions array = [
+  'Microsoft.Batch/batchAccounts/jobSchedules/write'
+  'Microsoft.Batch/batchAccounts/jobSchedules/delete'
+  'Microsoft.Batch/batchAccounts/jobSchedules/read'
+  'Microsoft.Batch/batchAccounts/jobs/write'
+  'Microsoft.Batch/batchAccounts/jobs/delete'
+  'Microsoft.Batch/batchAccounts/jobs/read'
+]
+param deniedActions array = []
+param deniedDataActions array = []
+
+module batchAccountCustomRole './custom.role.bicep' = {
+  name: 'custom-role-for-${batchAccountName}'
+  params: {
+    roleName: 'custom-role-for-${batchAccountName}'
+    roleDescription: 'Custom Role for Accessing Batch Accounts'
+    allowedActions: allowedActions
+    allowedDataActions: allowedDataActions
+    deniedActions: deniedActions
+    deniedDataActions: deniedDataActions
+  }
+}
+
+output batchAccountCustomRoleName string = batchAccountCustomRole.outputs.customRoleID

deploy/infra/modules/custom.role.bicep

@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+targetScope = 'subscription'
+
+param roleName string
+param roleDescription string = ''
+param allowedActions array = []
+param allowedDataActions array = []
+param deniedActions array = []
+param deniedDataActions array = []
+
+resource customRole 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' = {
+  name: guid(roleName)
+  properties: {
+    description: roleDescription
+    assignableScopes: [
+      subscription().id
+    ]
+    permissions: [
+      {
+        actions: allowedActions
+        dataActions: allowedDataActions
+        notActions: deniedActions
+        notDataActions: deniedDataActions
+      }
+    ]
+    roleName: roleName
+    type: 'CustomRole'
+  }
+}
+
+output customRoleID string = customRole.id