fusion-roles-cli

Fusion Roles CLI

When to use

Use when Fusion Roles V2 resources (roles, bindings, assignments, scope types) need to be created or updated from a config file, or when existing role state needs to be inspected or exported.

Typical triggers:

• "Deploy the roles config for my service"
• "Create roles from this JSON file"
• "Export the current role config for fusion-myservice"
• "What does a roles config file look like?"
• "Add a binding for this Entra group"
• "Check what roles are assigned to this account"
• "Dry-run the role deployment"

When not to use

• Database provisioning — use fusion-infra-cli
• Managing Azure AD groups themselves — use the Azure portal or Graph API
• Roles V1 (legacy system) — this tool targets Roles V2 only
• Application code changes

Prerequisites

Install froles as a .NET global tool:

dotnet tool install --global \
  --add-source "https://statoil-proview.pkgs.visualstudio.com/Fusion%20-%20Packages/_packaging/Fusion-Public/nuget/v3/index.json" \
  Fusion.Roles.Cli

Update to latest:

froles --update

Auth uses DefaultAzureCredential automatically (picks up az login session). Pass -t <token> to override.

Core workflow — deploy a role config

1. Create the config file

The config file is a JSON file declaring all role resources for your system. Always include the $schema reference — it enables editor validation and autocompletion.

Minimal example (roles-config.json):

{
  "$schema": "https://rolesv2.api.fusion.equinor.com/public/schemas/role-config.schema.json",
  "accessRoles": [
    {
      "systemIdentifier": "my-service",
      "name": "MyService.Project.Read",
      "description": "Read access to project resources"
    }
  ],
  "roles": [
    {
      "name": "project-viewer",
      "displayName": "Project Viewer",
      "accessRoleMappings": [
        { "accessRoleIdentifier": "MyService.Project.Read" }
      ]
    }
  ]
}

See references/role-config-schema.md for the full schema with all resource types and field definitions.