ruby-on-rails - 尝试使用 Ruby api 创建虚拟机实例时出现错误 MsRestAzure::AzureOperationError: AuthorizationFailed

Question

我是 Azure 平台的新手。我已经按照此链接生成服务原理:https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal

当我到达步骤:将应用程序分配给角色>第 6 点(搜索您的应用程序，然后选择它。) 我在搜索结果中看不到我的应用程序。

之后我尝试使用 ruby​​ api 创建虚拟机:

https://github.com/Azure/azure-sdk-for-ruby/tree/master/management/azure_mgmt_compute

当我实现代码来创建虚拟机时，出现以下错误:

"message": "MsRestAzure::AzureOperationError: AuthorizationFailed: The client 'xxxx' with object id 'xxxx' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/write' over scope '/subscriptions/xxxx/resourceGroups/my_group/providers/Microsoft.Compute/virtualMachines/test-ubuntu3'.",

在上面的错误消息中，客户端和对象 ID 相同。我不知道为什么以及对象 id 的含义是什么。

我该如何解决这个问题？我应该在门户中查看哪里？任何帮助将不胜感激。

谢谢

Answer 1

根本原因是您使用的服务主体在该租户中没有拥有权限。

租户拥有订阅，服务主体属于租户。 Azure 资源管理器还公开给定主体的基于角色的授权，这将赋予其对 Azure 资源的权限。服务主体似乎无权读取该订阅。

请使用 Azure CLI 2.0 创建服务主体:

az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/mySubscriptionID/resourceGroups/myResourceGroupName"

这里是关于CLI 2.0的信息创建服务主体:

C:\Users>az ad sp create-for-rbac -h

Command
    az ad sp create-for-rbac: Create a service principal and configure its access to Azure
    resources.

Arguments
    --cert           : PEM or DER formatted public certificate using string or `@<file path>` to
                       load from a file. Do not include private key info.
    --create-cert    : Create and upload self-signed certificate which you can use to login.
    --expanded-view  : Once created, display more information like subscription and cloud
                       environments.
    --name -n        : A display name or an app id uri. Command will generate one if missing.
    --password -p    : The password used to login. If missing, command will generate one.
    --role           : Role the service principal has on the resources.  Default: Contributor.
    --scopes         : Space separated scopes the service principal's role assignment applies to.
                       Defaults to the root of the current subscription.
    --skip-assignment: Do not create default assignment.
    --years          : Years the password will be valid. Default: 1 year.

Global Arguments
    --debug          : Increase logging verbosity to show all debug logs.
    --help -h        : Show this help message and exit.
    --output -o      : Output format.  Allowed values: json, jsonc, table, tsv.  Default: json.
    --query          : JMESPath query string. See http://jmespath.org/ for more information and
                       examples.
    --verbose        : Increase logging verbosity. Use --debug for full debug logs.

Examples
    Create with a default role assignment.
        az ad sp create-for-rbac

    Create using a custom name, and with a default assiggment.
        az ad sp create-for-rbac -n "http://MyApp"

    Create without a default assignment.
        az ad sp create-for-rbac --skip-assignment

    Create with customized assignments
        az ad sp create-for-rbac -n "http://MyApp" --role contributor --scopes
        /subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/MyResourceGroup
        /subscriptions/11111111-2222-3333-4444-666666666666/resourceGroups/MyAnotherResourceGroup

    Create using self-signed certificte
        az ad sp create-for-rbac --create-cert

    Login with a service principal.
        az login --service-principal -u <name> -p <password> --tenant <tenant>

    Login with self-signed certificate
        az login --service-principal -u <name> -p <certificate file path> --tenant <tenant>

    Reset credentials on expiration.
        az ad sp reset-credentials --name <name>

    Create extra role assignments in future.
        az role assignment create --assignee <name> --role Contributor

    Revoke the service principal when done with it.
        az ad app delete --id <name>

    Create using certificate from Key Vault
        az keyvault certificate download --vault-name vault -n cert-name -f cert.pem
        az ad sp create-for-rbac --cert @cert.pem