0

我有以下情况。

  1. 拥有我工作场所的帐户和 Visual Studio Professional 订阅。
  2. 我无法在我的组织租户中创建服务主体。这是被禁止的，我不会被授予这样做的特权。
  3. 我自己创建了一个新租户，说“myowntenant”。创建了一个新应用程序，因此，我得到了一个名为“example-app”的服务主体
  4. 然后，我转到 Visual Studio 订阅并授予服务主体（示例应用程序）贡献者对订阅的访问权限。

当我尝试使用“example-app”的 VS 订阅 ID、我自己的租户 ID、客户端 ID 和机密来使用我的 terraform 环境时，我收到未经授权的错误，说明访问令牌来自错误的颁发者。

看起来我对 Azure 订阅、租户和服务主体的理解不正确。有人可以告诉我为什么即使服务主体在订阅中具有贡献者访问权限，这也不起作用？

地形代码：

## <https://www.terraform.io/docs/providers/azurerm/index.html>
provider "azurerm" {
  version = "=2.5.0"
  features {}
}

## <https://www.terraform.io/docs/providers/azurerm/r/resource_group.html>
resource "azurerm_resource_group" "rg" {
  name     = "TerraformTesting"
  location = "eastus"
}

## <https://www.terraform.io/docs/providers/azurerm/r/availability_set.html>
resource "azurerm_availability_set" "DemoAset" {
  name                = "example-aset"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

## <https://www.terraform.io/docs/providers/azurerm/r/virtual_network.html>
resource "azurerm_virtual_network" "vnet" {
  name                = "vNet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

## <https://www.terraform.io/docs/providers/azurerm/r/subnet.html> 
resource "azurerm_subnet" "subnet" {
  name                 = "internal"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefix       = "10.0.2.0/24"
}

## <https://www.terraform.io/docs/providers/azurerm/r/network_interface.html>
resource "azurerm_network_interface" "example" {
  name                = "example-nic"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.subnet.id
    private_ip_address_allocation = "Dynamic"
  }
}

## <https://www.terraform.io/docs/providers/azurerm/r/windows_virtual_machine.html>
resource "azurerm_windows_virtual_machine" "example" {
  name                = "example-machine"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  size                = "Standard_F2"
  admin_username      = "adminuser"
  admin_password      = "P@$$w0rd1234!"
  availability_set_id = azurerm_availability_set.DemoAset.id
  network_interface_ids = [
    azurerm_network_interface.example.id,
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2016-Datacenter"
    version   = "latest"
  }
}
4

1 回答 1

0

结合您的另一篇文章，无法实现第4步，因此您收到此错误。

一个租户可以有多个订阅，但一个订阅只能绑定到一个租户。

您错误地认为您已成功授予名为“example-app”的服务主体（来自另一个租户）对订阅的贡献者访问权限，因为此订阅中有同名的服务主体。

所以你的设计无法实现。

于 2021-06-15T02:24:38.633 回答