What roles are available for Azure Container Instances operator

Question

I'd like to assign a user assigned manage identity a role in resource group scope for Azure Container Instances related operation, such as list containers in a RG, start or stop an container group, is there any build-in role available for this purpose? I searched in the role list, not find any:

Answer 1

Usually,to use a managed identity, that particular identity should have the access granted to following one or more Azure service resources like azure web app, azure key vault(with access policies or roles), or azure storage account in the subscription.

Select Access control (IAM).

and Add role assignment

• Select roles , select appropriate role that you want the user identity to
  have.

• Here i am giving for storage access
• To give storage access select storage blob data reader role or contributer role

• Then select the managed identity and select required user managed identity.

But please note that from Limitations: Enable managed identity in container group - Azure Container Instances | Microsoft Docs

1. Currently you can't use a managed identity in a container group deployed to a virtual network.

2. Container groups which are running in Azure Virtual Networks do not support managed identity authentication image pulls with ACR.

If system assigned identity is enabled, then the group must have 'Contributor' role in order to have access to a storage account.

Reference: use-a-managed-identity | Microsoft Docs