azure-rest-api - 在 Azure RBAC 自定义角色中找出正确的操作集

Question

有这个 Azure 函数需要调用Azure REST API。

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/config/web?api-version=2019-08-01

并且该函数应该具有尽可能少的权限。我有一个自定义角色（从订阅级别的贡献者克隆），分配给订阅级别的功能。JSON如下：

{
    "properties": {
        "roleName": "Web config contributor",
        "description": "Custom role that can read resources under subscription and update their web config.",
        "assignableScopes": [
            "/subscriptions/def-abc-45346-9477-xyz"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read",
                    "Microsoft.Web/*"
                ],
                "notActions": [
                    "Microsoft.Authorization/*/Delete",
                    "Microsoft.Authorization/*/Write",
                    "Microsoft.Authorization/elevateAccess/Action",
                    "Microsoft.Blueprint/blueprintAssignments/write",
                    "Microsoft.Blueprint/blueprintAssignments/delete"
                ],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

它似乎工作的唯一一点是如果actions设置为*. 否则它会抛出403 (Forbidden)。我努力了：

"Actions": [
    "*/read",
    "Microsoft.Web/sites/config/Write",
    "Microsoft.web/sites/config/delete"
  ]

"Actions": [
    "*/read",
    "Microsoft.Web/sites/*"
  ]

"Actions": [
    "*/read",
    "Microsoft.Web/*"
  ]

确定自定义角色允许哪些操作以使 REST 操作正常工作的方法是什么？

Answer 1

根据我的测试，Microsoft.Web/sites/config/Write足够了。

我的自定义角色供您参考。

{
    "properties": {
        "roleName": "testrole005",
        "description": "",
        "assignableScopes": [
            "/subscriptions/e5b0fcfa-e859-43f3-8d84-5xxxx29fxxxx"
        ],
        "permissions": [
            {
                "actions": [    
                    "*/read",
                    "Microsoft.Web/sites/config/Write"
                    ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}