Question

我有两个AAD应用程序（服务主体），并希望使用arm模板将RBAC添加到这两个应用程序中。

我尝试使用下面的arm模板进行部署。

    {
        "type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
        "apiVersion": "2018-09-01-preview",
        "name": "[concat(parameters('StorageAccountName'), '/default/',parameters('ContainerName'), '/Microsoft.Authorization/', parameters('roleNameGuid'))]",
        "properties": {
          "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
          "principalId": "[parameters('principalId')]"
        }      
    },
    {
        "type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
        "apiVersion": "2018-09-01-preview",
        "name": "[concat(parameters('StorageAccountName'), '/default/',parameters('ContainerName'), '/Microsoft.Authorization/', parameters('roleNameGuid'))]",
        "properties": {
          "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
          "principalId": "[parameters('principalId2')]"
        }      
    }

当我使用该手臂模板进行部署时，下面出现错误。

    Deployment template validation failed: 'The resource 'Microsoft.Storage/storageAccounts/MystorageAccounts/blobServices/default/containers/test/providers/Microsoft.Authorization/roleAssignments/aacd4b89-a70f-4be9-a0ba-6b8698dd7129' at line '52' and column '9' is defined multiple times in a template. Please see https://aka.ms/arm-template/#resources for usage details.'. (Code: InvalidTemplate)

Answer 1

您需要为资源中的name选项使用不同的名称。例如，您可以在名称的末尾附加一个数字以区分差异。

Answer 2

这是否也行得通，并且不使用GUID的硬编码值？： https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-functions-string#guid

是的，将需要一些输入来计算不同的GUID，但是您可以使用属性迭代来更改它： https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-multiple#property-iteration

如何在Azure中使用Arm模板将RBAC分配给多个用户

2 个答案: