Question

此Azure函数需要调用Azure REST API。

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/config/web?api-version=2019-08-01

该函数应具有尽可能少的权限。我有一个自定义角色（从订阅级别contributor中克隆），已分配给订阅级别的功能。 JSON如下：

{
    "properties": {
        "roleName": "Web config contributor",
        "description": "Custom role that can read resources under subscription and update their web config.",
        "assignableScopes": [
            "/subscriptions/def-abc-45346-9477-xyz"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read",
                    "Microsoft.Web/*"
                ],
                "notActions": [
                    "Microsoft.Authorization/*/Delete",
                    "Microsoft.Authorization/*/Write",
                    "Microsoft.Authorization/elevateAccess/Action",
                    "Microsoft.Blueprint/blueprintAssignments/write",
                    "Microsoft.Blueprint/blueprintAssignments/delete"
                ],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

似乎唯一可行的方法是将actions设置为*。否则抛出403 (Forbidden)。我尝试过：

"Actions": [
    "*/read",
    "Microsoft.Web/sites/config/Write",
    "Microsoft.web/sites/config/delete"
  ]

"Actions": [
    "*/read",
    "Microsoft.Web/sites/*"
  ]

"Actions": [
    "*/read",
    "Microsoft.Web/*"
  ]

如何确定允许自定义角色执行哪些操作才能使REST操作起作用？

Answer 1

根据我的测试，Microsoft.Web/sites/config/Write就足够了。

我的自定义角色供您参考。

{
    "properties": {
        "roleName": "testrole005",
        "description": "",
        "assignableScopes": [
            "/subscriptions/e5b0fcfa-e859-43f3-8d84-5xxxx29fxxxx"
        ],
        "permissions": [
            {
                "actions": [    
                    "*/read",
                    "Microsoft.Web/sites/config/Write"
                    ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

找出Azure RBAC自定义角色中的正确操作集

1 个答案: