python - 如何使用 python 生成身份验证 token 并列出 azure 中的资源组？

Question

我尝试过以下代码:

from azure.identity import ClientSecretCredential
import requests

subscription_id = 'MYSUBID'
client_id = 'MYCLIENTID'
client_secret = 'MYSECRETVALUE'
tenant_id = 'MYTENANTID'

# Create a ClientSecretCredential object
credential = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)

url = f"https://management.azure.com/subscriptions/{subscription_id}/resourcegroups?api-version=2021-04-01"
# Get an access token for the Azure Management API
access_token = credential.get_token("https://management.azure.com/.default")


# Make the GET request to retrieve a list of resource groups
headers = {
    "Authorization": f"Bearer {access_token}"
}

response = requests.get(url, headers=headers)

if response.status_code == 200:
    resource_groups = response.json()
    for rg in resource_groups['value']:
        print(rg['name'])
else:
    print(response.status_code, "-" ,response.text)

所以这段代码给了我以下错误:

403 - {"error":{"code":"AuthorizationFailed","message":"客户端 'f89e9744-3f48-444c-bf6f-525d15974a46' 对象 ID 'f89e9744-3f48-444c-bf6f-525d15974a46 ' 无权在范围 '/subscriptions/MYSUBID' 上执行操作 'Microsoft.Resources/subscriptions/resourcegroups/read' 或范围无效。如果最近授予了访问权限，请刷新您的凭据。"}}

但是当我使用这个网站列出它时https://learn.microsoft.com/en-us/rest/api/resources/resource-groups/list?tryIt=true&source=docs#code-try-0

它成功列出了资源组。然后我才知道不记名 token 或身份验证 token 是不同的。

帮助解决此问题。

Answer 1

403 - {"error":{"code":"AuthorizationFailed","message":"The client'f89e9744-3f48-44xxx' with object id 'f89e9744-3f48xxxx5974a46' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read'over scope '/subscriptions/MYSUBID' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

上述错误告诉我们您的应用程序没有列出资源组的适当权限或角色。

要列出资源组，您需要读者角色。您可以通过门户分配角色:

转至 Azure 门户 -> 订阅 -> 访问控制 (IAM) -> 添加 -> 添加角色分配 -> 搜索(读者角色) -> 选择成员(您的应用程序) -> 单击审核+ 分配。

分配角色后，我使用以下代码来获取资源组列表。

代码:

from azure.identity import ClientSecretCredential
import requests

subscription_id = 'xxx'
client_id = 'xxx'
client_secret = 'xxxxx'
tenant_id = 'xxxx'

# Create a ClientSecretCredential object
credential = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)

url = f"https://management.azure.com/subscriptions/{subscription_id}/resourcegroups?api-version=2021-04-01"
# Get an access token for the Azure Management API
access_token = credential.get_token("https://management.azure.com/.default").token

# Make the GET request to retrieve a list of resource groups
h1 = {
    "Authorization": f"Bearer {access_token}"
}
response = requests.get(url,headers=h1)

if response.status_code == 200:
    resource_groups = response.json()
    print(f"-----Resource Group Names------")
    for rg in resource_groups['value']:
        print(rg['name'])
else:
    print(response.status_code, "-" ,response.text)

输出:

引用:

Resource Groups - List - REST API (Azure Resource Management) | Microsoft Learn