Question

我正在尝试使用以下模板将角色分配给“ Cosmos Db帐户”。

 {
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "principalId": {
            "type": "string",
            "defaultValue": "gb9e32f1-678f-4552-ae0a-0000f765aaaa",
            "metadata": {
                "description": ""
            }
        },
        "CosmosDbAccountName": {
            "type": "string",
            "defaultValue": "cosmosdbaccount",
            "metadata": {
                "description": "Cosmos Db Account name"
            }
        },
        "RoleType": {
            "defaultValue" : "Contributor",
            "type": "string",
            "metadata": {
                "description": "Built-in role to assign"
            },
            "allowedValues" : [
                "Contributor"
            ]
        }
    },
    "variables": {
         "Scope": "[concat(parameters('CosmosDbAccountName'),'/Microsoft.Authorization/',guid(subscription().subscriptionId))]"
     
     },

    "resources": [
        {
            "type": "Microsoft.DocumentDB/databaseAccounts/providers/roleAssignments",
            "name": "[variables('Scope')]",
            "apiVersion":"2020-04-01-preview",
            "properties": {
                "RoleDefinitionId":"/subscriptions/[subscription().subscriptionId]/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
                "principalId":  "[parameters('principalId')]"
            }
        }
    ]
}

我目前收到错误消息

{“代码”：“ DeploymentFailed”，“消息”：“至少一项资源部署操作失败。请列出部署操作以了解详细信息。请参阅https://aka.ms/DeployOperations以获取使用详细信息。”，“详细信息”：[ {“代码”：“ BadRequest”，“消息”：“ {\ r \ n”错误“：{\ r \ n”代码“：” RoleAssignmentUpdateNotPermitted“，\ r \ n”消息“：”租户ID，应用程序ID ，主体ID和范围不允许更新。“ \ r \ n} \ r \ n}”}]}

Answer 1

我认为现有的角色分配与您尝试通过此模板创建的名称相同，最终会出现错误“ RoleAssignmentUpdateNotPermitted”。

对模板的少量更改可以解决您的问题，例如生成唯一的GUID，然后将其与cosmos DB帐户名结合使用，请尝试以下更新的模板：

   {
        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "parameters": {
            "principalId": {
                "type": "string",
                "defaultValue": "gb9e32f1-678f-4552-ae0a-0000f765aaaa",
                "metadata": {
                    "description": ""
                }
            },
            "CosmosDbAccountName": {
                "type": "string",
                "defaultValue": "cosmosdbaccount",
                "metadata": {
                    "description": "Cosmos Db Account name"
                }
            },
            "RoleType": {
                "defaultValue" : "Contributor",
                "type": "string",
                "metadata": {
                    "description": "Built-in role to assign"
                },
                "allowedValues" : [
                    "Contributor"
                ]
            },
            "guid": {
                "defaultValue": "[newGuid()]",
                "type": "String"
            }
        },
        "variables": {
             "Scope": "[concat(parameters('CosmosDbAccountName'),'/Microsoft.Authorization/', parameters('guid'))]"
         
         },
    
        "resources": [
            {
                "type": "Microsoft.DocumentDB/databaseAccounts/providers/roleAssignments",
                "name": "[variables('Scope')]",
                "apiVersion":"2020-04-01-preview",
                "properties": {
                    "RoleDefinitionId":"/subscriptions/[subscription().subscriptionId]/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
                    "principalId":  "[parameters('principalId')]"
                }
            }
        ]
    }

通过ARM模板将角色分配给cosmos db

1 个答案: