{
    "properties": {
        "roleName": "InsightCloudSec Reader Plus User Role (Subscription)",
        "description": "Provides read-only access to all Azure resources plus some additional permissions not covered by the built-in Reader role for a given Subscription.",
        "assignableScopes": [
            "/subscriptions/<subscription-id>"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read",
                    "Microsoft.ContainerRegistry/registries/pull/read",
                    "Microsoft.Web/sites/config/list/Action",
                    "Microsoft.Web/sites/slots/config/list/Action"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}