You have an azure subscription named sub1. you create a new azure role named role1 by cloning the contributor role and adding the microsoft.compute/*/write to the notactions section. a user named admin1 plans to create the following resources: a virtual machine named vm1 a bastion host named bastion1 a container named container1 you assign role1 to admin1 for sub1. which resource or resources can admin1 create in sub1?