api - 如何使用 RBAC API 获取所有角色分配的列表

Question

我向以下 API 发出 GET 请求

https://management.azure.com/subscriptions/{{subscriptionId}}/providers/Microsoft.Authorization/roleAssignments?api-version=2017-10-01-preview

这给了我以下响应格式

{
            "properties": {
                "roleDefinitionId": "/subscriptions/5a9c0639-4045-4c23-8418-fc091e8d1e31/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
                "principalId": "fdef6f38-b48f-4358-8482-b243ea935082",
                "principalType": "User",
                "scope": "/subscriptions/5a9c0639-4045-4c23-8418-fc091e8d1e31/resourceGroups/GE-RGrp-Kentico",
                "createdOn": "2017-08-21T11:38:53.7973201Z",
                "updatedOn": "2017-08-21T11:38:53.7973201Z",
                "createdBy": "f418e9e8-becc-41d8-ab47-66a4c50403b5",
                "updatedBy": "f418e9e8-becc-41d8-ab47-66a4c50403b5"
            },
            "id": "/subscriptions/5a9c0639-4045-4c23-8418-fc091e8d1e31/resourceGroups/GE-RGrp-Kentico/providers/Microsoft.Authorization/roleAssignments/5e6caac9-c5fd-42f0-86c6-9e96b127be51",
            "type": "Microsoft.Authorization/roleAssignments",
            "name": "5e6caac9-c5fd-42f0-86c6-9e96b127be51"
        }

但是当我进行 CLI 调用时，我得到以下响应

> az  role assignment list

{
    "id": "/subscriptions/5a9c0639-4045-4c23-8418-fc091e8d1e31/providers/Microsoft.Authorization/roleAssignments/4096c146-b6f8-4f92-a700-a47742a5b321",
    "name": "4096c146-b6f8-4f92-a700-a47742a5b321",
    "properties": {
      "additionalProperties": {
        "createdBy": "c2024d65-cf17-45fd-b34b-09cd5c21cac7",
        "createdOn": "2017-11-07T22:03:12.4998370Z",
        "updatedBy": "c2024d65-cf17-45fd-b34b-09cd5c21cac7",
        "updatedOn": "2017-11-07T22:03:12.4998370Z"
      },
      "principalId": "780925c0-a487-4529-9eb2-837aa67a4d8a",
      "principalName": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="0e766d6f786f606f7e4e696b606b7d677d6b606b7c6977206d61206074" rel="noreferrer noopener nofollow">[email protected]</a>",
      "roleDefinitionId": "/subscriptions/5a9c0639-4045-4c23-8418-fc091e8d1e31/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd",
      "roleDefinitionName": "Security Admin",
      "scope": "/subscriptions/5a9c0639-4045-4c23-8418-fc091e8d1e31"
    },

上面的回复确实有

"roleDefinitionName": "Security Admin"

但我想通过 API 得到相同的响应，请帮助!!

Answer 1

要获取角色定义名称，您需要进行单独的 REST API 调用，然后在客户端执行联接。

如果在运行 Azure PowerShell 或 Azure CLI 时运行网络捕获，则可以直接看到 REST API 调用。

列出角色分配

GET https://management.azure.com/subscriptions/ {subscriptionId}/providers/Microsoft.Authorization/roleAssignments?api-version=2015-07-01

响应示例:

"value": [
    {
        "properties": {
            "roleDefinitionId": "/subscriptions/<subscriptionId>/providers/Microsoft.Authorization/roleDefinitions/<roleDefinitionId>",
            "principalId": "<principalId>",
            "scope": "/subscriptions/<subscriptionId>",
            "createdOn": "2017-02-03T07:55:59.6345664Z",
            "updatedOn": "2017-02-03T07:55:59.6345664Z",
            "createdBy": "7c728184-cd9e-47ad-b72f-e7ac40b80624",
            "updatedBy": "7c728184-cd9e-47ad-b72f-e7ac40b80624"
        },
        "id": "/subscriptions/<subscriptionId>/providers/Microsoft.Authorization/roleAssignments/ea667734-e984-4726-bf0b-2116aaaedfde",
        "type": "Microsoft.Authorization/roleAssignments",
        "name": "ea667734-e984-4726-bf0b-2116aaaedfde"
    },

列出角色定义

获取 https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions ?$filter=atScopeAndBelow()&api-version=2015-07-01

响应示例:

    {
        "properties": {
            "roleName": "Contributor",
            "type": "BuiltInRole",
            "description": "Lets you manage everything except access to resources.",
            "assignableScopes": [
                "/"
            ],
            "permissions": [
                {
                    "actions": [
                        "*"
                    ],
                    "notActions": [
                        "Microsoft.Authorization/*/Delete",
                        "Microsoft.Authorization/*/Write",
                        "Microsoft.Authorization/elevateAccess/Action"
                    ]
                }
            ],
            "createdOn": "0001-01-01T08:00:00.0000000Z",
            "updatedOn": "2016-12-14T02:04:45.1393855Z",
            "createdBy": null,
            "updatedBy": null
        },
        "id": "/providers/Microsoft.Authorization/roleDefinitions/<roleDefinitionId>",
        "type": "Microsoft.Authorization/roleDefinitions",
        "name": "<roleDefinitionId>"
    },

获取 AAD 对象 - 包括主体名称

POST https://graph.windows.net//getObjectsByObjectIds?api-version=1.6

{
  "objectIds": [
    "<objectId1>",
    "<objectId2>",
    ...
  ],
  "includeDirectoryObjectReferences": true
}