azure - 通过自动化为多个资源组上的托管身份添加 RBAC 角色

Question

有没有办法通过自动化(CLI、PowerShell、Terraform 等)在多个资源组上为基于 usr 的托管身份添加 RBAC 角色。这将节省我手动添加多个资源组权限的时间。

我从这个开始，它为我提供了托管身份的对象 ID。az resource list -g "RG Name"--query "[?identity!=null].{name: name, objectIds: Identity.principalId}"

谢谢!

Answer 1

RBAC role for a usr based managed identity on multiple resource groupsvia automation (CLI, PowerShell, Terraform etc).

• 以下是不同服务 Terraform CLI 和 PowerShell 的 RBAC 规则的代码。

CLI:

az role assignment create --role
                          [--assignee]
                          [--assignee-object-id]
                          [--assignee-principal-type {ForeignGroup, Group, ServicePrincipal, User}]
                          [--condition]
                          [--condition-version]
                          [--description]
                          [--resource-group]
                          [--scope]

PowerShell:

New-AzRoleAssignment
   -ObjectId <String>
   [-Scope <String>]
   -RoleDefinitionName <String>
   [-Description <String>]
   [-Condition <String>]
   [-ConditionVersion <String>]
   [-ObjectType <String>]
   [-AllowDelegation]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Terraform:

data "azurerm_subscription" "primary" {
}

data "azurerm_client_config" "example" {
}

resource "azurerm_role_definition" "example" {
  role_definition_id = "00000000-0000-0000-0000-000000000000"
  name               = "my-custom-role-definition"
  scope              = data.azurerm_subscription.primary.id

  permissions {
    actions     = ["Microsoft.Resources/subscriptions/resourceGroups/read"]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id,
  ]
}

resource "azurerm_role_assignment" "example" {
  name               = "00000000-0000-0000-0000-000000000000"
  scope              = data.azurerm_subscription.primary.id
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = data.azurerm_client_config.example.object_id
}