azure - 如何查找我的 Azure 服务主体需要哪些操作/权限

Question

我正在尝试使用最低权限锁定我的 Azure 服务主体。这可以通过 creating custom roles 来完成。但在定义自定义角色时，我如何知道给定任务需要执行哪些操作？例如，如果自动化帐户需要在 powershell 脚本中运行多个 AzureRm cmdlet( Get-AzureKeyVaultSecret 、 New-AzureRmContainerGroup 、 Get-AzureRmContext 等)，我如何找出哪些“操作”这些命令中的每一个都执行吗？

Get-AzureRMProviderOperation *列出所有可用的操作(当前呈现 2969 个列表——对于排序来说，这个数字有点压倒性)。我如何确定我需要哪些？

Answer 1

例如，如果您想使用 Azure 自动化帐户来运行 Runbook 命令
Get-AzureKeyVaultSecret，我们应该授予该 SP 权限，例如:

微软授权: Microsoft 自动化:Microsoft.Automation/automationAccounts/runbooks/read

Microsoft.KeyVault 需要这些权限:

Microsoft.KeyVault/vaults/read 
Microsoft.KeyVault/vaults/secrets/read
Microsoft.KeyVault/vaults/accessPolicies/write

通常，我们可以为每个提供商设置角色。例如，Microsoft.KeyVault，我们希望SP可以更新 key 保管库或读取 secret ，我们可以添加Microsoft.KeyVault/vaults/write和Microsoft.KeyVault/Vaults/secrets/read 和 Microsoft.KeyVault/vaults/read。

PS C:\Users\jason> Get-AzureRmProviderOperation * | ?{ $_.ProviderNamespace -eq 'Microsoft Key Vault' } | select Operation, OperationName

Operation                                               OperationName
---------                                               -------------
Microsoft.KeyVault/register/action                      Register Subscription
Microsoft.KeyVault/unregister/action                    Unregister Subscription
Microsoft.KeyVault/hsmPools/read                        View HSM pool
Microsoft.KeyVault/hsmPools/write                       Create or Update HSM pool
Microsoft.KeyVault/hsmPools/delete                      Delete HSM pool
Microsoft.KeyVault/hsmPools/joinVault/action            Join KeyVault to HSM pool
Microsoft.KeyVault/checkNameAvailability/read           Check Name Availability
Microsoft.KeyVault/vaults/read                          View Key Vault
Microsoft.KeyVault/vaults/write                         Update Key Vault
Microsoft.KeyVault/vaults/delete                        Delete Key Vault
Microsoft.KeyVault/vaults/deploy/action                 Use Vault for Azure Deployments
Microsoft.KeyVault/vaults/secrets/read                  View Secret Properties
Microsoft.KeyVault/vaults/secrets/write                 Update Secret
Microsoft.KeyVault/vaults/accessPolicies/write          Update Access Policy
Microsoft.KeyVault/operations/read                      Available Key Vault Operations
Microsoft.KeyVault/deletedVaults/read                   View Soft Deleted Vaults
Microsoft.KeyVault/locations/operationResults/read      Check Operation Result
Microsoft.KeyVault/locations/deletedVaults/read         View Soft Deleted Key Vault
Microsoft.KeyVault/locations/deletedVaults/purge/action Purge Soft Deleted Key Vault

完成后，我们可以将此角色分配给您想要Get-AzureKeyVaultSecret的 SP。我们可以为一个 SP 分配多个角色。

注意:

每个服务主体都需要 Microsoft Authorization 权限，否则该 SP 将无法登录 Azure。

通常情况下，Azure PowerShell 命令 Get 需要读取权限，New、set 和 Update 需要写入权限。

希望这有帮助:)