python - Azure 日志分析 InsufficientAccessError

Question

我正在尝试用 python 读取日志分析。这是我的代码:

AZURE_CLIENT_ID = ''
AZURE_CLIENT_SECRET = ''
AZURE_TENANT_ID = ''
workspace_id = ''
from azure.identity import ClientSecretCredential
from datetime import datetime
from azure.monitor.query import LogsQueryClient, LogsQueryStatus


start_time = datetime(2022, 1, 1)
end_time = datetime(2023, 1, 2)
credential  = ClientSecretCredential(
        client_id = AZURE_CLIENT_ID,
        client_secret = AZURE_CLIENT_SECRET,
        tenant_id = AZURE_TENANT_ID
    )

client = LogsQueryClient(credential)
query = "ContainerLog"

response = client.query_workspace(workspace_id=workspace_id,
                                  query=query, timespan=(start_time, end_time - start_time))

if response.status == LogsQueryStatus.PARTIAL:
    error = response.partial_error
    print('Results are partial', error.message)

elif response.status == LogsQueryStatus.SUCCESS:
    results = []
    for table in response.tables:
        for row in table.rows:
            results.append(dict(zip(table.columns, row)))
    print(convert_azure_table_to_dict(results))

它失败了:

Traceback (most recent call last):
  File "c:\temp\x.py", line 24, in <module>
    response = client.query_workspace(workspace_id=workspace_id,
  File "C:\kourosh\venv\lib\site-packages\azure\core\tracing\decorator.py", line 78, in wrapper_use_tracer
    return func(*args, **kwargs)
  File "C:\kourosh\venv\lib\site-packages\azure\monitor\query\_logs_query_client.py", line 136, in query_workspace
    process_error(err, LogsQueryError)
  File "C:\kourosh\venv\lib\site-packages\azure\monitor\query\_helpers.py", line 141, in process_error
    raise HttpResponseError(message=error.message, response=error.response, model=model)
azure.core.exceptions.HttpResponseError: (InsufficientAccessError) The provided credentials have insufficient access to perform the requested operation
Code: InsufficientAccessError
Message: The provided credentials have insufficient access to perform the requested operation

我已将 Log Analytics API -> Data.Read 权限添加到我正在使用的注册应用程序中。知道是什么原因造成的吗？

Answer 1

Data.Read 提供使用 API 的权限并授予您的应用访问 Log Analytics 工作区的权限。但是，为了访问日志分析工作区中的数据，您需要根据需要访问的数据提供权限。

引用文献:

• https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api
• https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access?tabs=portal