ARO-RP/deploy/rp-production-global-subscription.json

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "resources": [
        {
            "name": "48983534-3d06-4dcb-a566-08a694eb1279",
            "type": "Microsoft.Authorization/roleDefinitions",
            "properties": {
                "roleName": "ARO v4 ContainerRegistry Token Contributor",
                "permissions": [
                    {
                        "actions": [
                            "Microsoft.ContainerRegistry/registries/generateCredentials/action",
                            "Microsoft.ContainerRegistry/registries/scopeMaps/read",
                            "Microsoft.ContainerRegistry/registries/tokens/delete",
                            "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
                            "Microsoft.ContainerRegistry/registries/tokens/read",
                            "Microsoft.ContainerRegistry/registries/tokens/write"
                        ]
                    }
                ],
                "assignableScopes": [
                    "[subscription().id]"
                ]
            },
            "apiVersion": "2018-01-01-preview"
        }
    ]
}