Azure 默认读取器与内置监控读取器

Question

我正在尝试从安全角度缩小监控数据的最佳角色范围。我的需求略有不同，因此我不想使用安全读者角色(主要是因为安全读者只能访问安全中心项目以及基本资源和资源组查询)。因此，在阅读更多内容后，我偶然发现了“监视读者角色”和“只是读者角色”。我检查了 JSON 中提到的权限。但是我不确定 JSON 中是否涵盖了所有差异。

例如，当我们谈论“监控读者”时

{
  "assignableScopes": [
    "/"
  ],
  "description": "Can read all monitoring data.",
  "id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/43d0d8ad-25c7-4714-9337-8ba259a9fe05",
  "name": "43d0d8ad-25c7-4714-9337-8ba259a9fe05",
  "permissions": [
    {
      "actions": [
        "*/read",
        "Microsoft.OperationalInsights/workspaces/search/action",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Monitoring Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

权限基本相同，只是可以查询日志。与读者角色相比

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you view everything, but not make any changes.",
  "id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "name": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
  "permissions": [
    {
      "actions": [
        "*/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

现在从逻辑的角度来看，如果两个用户都能够执行 */read，那么 Reader 角色是否会自动有资格查询日志？如果不是，有什么不同？另外，在访问可读数据方面哪个角色更优越？

引用:https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader

PS:我确实了解自定义角色，但想更好地了解内置角色。

Answer 1

Now from a logical standpoint if both the users are able to execute */read doesn't Reader role automatically qualify to query the logs?

它们都能够执行*/read，但Reader无法查询日志。

If not, how is it different?

区别在于Monitoring Reader可以执行Microsoft.OperationalInsights/workspaces/search/action和Microsoft.Support/*操作。

Also which role is superior in terms of access to readable data?

从角色定义的actions范围来看，显然Monitoring Reader在访问可读数据方面更胜一筹。