Azure RBAC 应用程序见解码件贡献者与监视贡献者

Question

我正在尝试了解 Azure RBAC 中这两个角色之间的重叠。看起来除了“Microsoft.Resources/deployments/*”之外，monitor-contributor 完全覆盖了 application-insights-component-contributor。考虑以下情况，我是否将 Web 可用性测试部署到 AppInsights 资源中，并且部署标识是已被授予监视贡献者权限的服务主体。我是否应该授予此身份“application-insights-component-contributor”以便能够创建这些资源，或者“监控贡献者”就足够了吗？

1 编辑

我还在部署警报规则以及测试和作为 rm 模板实现的规则，如果 SP 被授予监控贡献者，那么它会失败

Error: requesting Validation for Template Deployment "app508-dfpg-dev3-diag-eastus2-backoffice-ai-test-dep" (Resource Group "app508-dfpg-ne-diag-eastus2"): resources.DeploymentsClient#Validate: Failure sending request: StatusCode=403 -- Original Error: Code="AuthorizationFailed" Message="The client '2c20abbf-e825-495c-9d06-90c5f04f9c60' with object id '2c20abbf-0000-0000-0000-90c5f04f9c60' does not have authorization to perform action 'Microsoft.Resources/deployments/validate/action' over scope '/subscriptions/s/resourcegroups/app508-dfpg-ne-diag-eastus2/providers/Microsoft.Resources/deployments/app508-dfpg-dev3-diag-eastus2-backoffice-ai-test-dep' or the scope is invalid. If access was recently granted, please refresh your credentials."

Answer 1

无需给出Application Insights Component Contributor角色，Monitoring Contributor角色就够了。部署 Web 可用性测试时，您只需要 Microsoft.Insights/webtests/* 操作权限，它已包含在 Monitoring Contributor 中。 .