Azure基於角色的用戶接入控制（RBAC）

本文轉載自查看原文 2016-09-15 14:04 1487

RBAC是Role Based Access Control是基於角色的接入控制的簡稱。在Azure推出ARM以后，對Azure各種資源的管理粒度已經非常細致，使得RBAC成為可能。

通過RBAC可以非常方便的給不同的用戶分配不同的資源的不同權限。

本文將以一個最通用的例子來介紹如何給一個用戶分配相關的權限。

一需求

用戶vmops只能對資源組1的虛擬機和資源組2的特定虛擬機進行開、關機或重啟的動作。其他所有操作權限都沒有。

二實現

1 創建用戶

在Azure的老Portal上創建創建用戶vmops@weiheng.partner.onmschina.cn

2 確定可以訪問的資源

vmops這個用戶可以操作的資源有：

Subscription 2中的Resource Group 1

Subscription 2中的Resource Group 2中的VM 1

Subscription 1中所有的VM

可以進行的操作有：

Start、restart、powerOff、Deallocate

3 通過PowerShell進行相關配置

A 首先需要得到VM可以操作的動作：

Get-AzureRMProviderOperation Microsoft.Compute/virtualMachines/* | ft operation
WARNING: The output object type of this cmdlet will be modified in a future release.
Operation
---------
Microsoft.Compute/virtualMachines/read
Microsoft.Compute/virtualMachines/write
Microsoft.Compute/virtualMachines/delete
Microsoft.Compute/virtualMachines/start/action
Microsoft.Compute/virtualMachines/powerOff/action
Microsoft.Compute/virtualMachines/redeploy/action
Microsoft.Compute/virtualMachines/restart/action
Microsoft.Compute/virtualMachines/deallocate/action
Microsoft.Compute/virtualMachines/generalize/action
Microsoft.Compute/virtualMachines/capture/action
Microsoft.Compute/virtualMachines/vmSizes/read
Microsoft.Compute/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachines/extensions/read
Microsoft.Compute/virtualMachines/extensions/write
Microsoft.Compute/virtualMachines/extensions/delete

B 獲取三種資源的ID

1 subscription ID

Get-AzureRmSubscription | ft SubscriptionID
SubscriptionId
--------------
$Sub1
$Sub2

2 Subscription 2 中的Resouce Group ID

Get-AzureRmResourceGroup | ft ResourceId
ResourceId
----------
/subscriptions/$Sub1/resourceGroups/hwnosql
/subscriptions/$Sub1/resourceGroups/hwiscsi

3 hwiscsi中vm1的Id

get-azurermvm -ResourceGroupName hwiscsi | ft id
Id
/subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsi01
/subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsi02
/subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsiwin

C 定義新的Role

首先獲得已有的Role的類型

Get-AzureRmRoleDefinition | ft name
Name
----
API Management Service Contributor
Application Insights Component Contributor
BizTalk Contributor
Classic Network Contributor
Classic Storage Account Contributor
Classic Virtual Machine Contributor
ClearDB MySQL DB Contributor
Contributor
Data Factory Contributor
DocumentDB Account Contributor
Intelligent Systems Account Contributor
Network Contributor
New Relic APM Account Contributor
Owner
Reader
Redis Cache Contributor
Scheduler Job Collections Contributor
Search Service Contributor
SQL DB Contributor
SQL Security Manager
SQL Server Contributor
Storage Account Contributor
User Access Administrator
Virtual Machine Contributor
Web Plan Contributor
Website Contributor

本方案通過Virtual Machine Contributor的模板修改。

#獲取"Virtual Machine Contributor"配置
$role = Get-AzureRmRoleDefinition "Virtual Machine Contributor" 
$role.Id = $null 
$role.Name = "Virtual Machine Operator" 
$role.Description = "Can monitor and start stop or restart virtual machines." 
$role.Actions.Clear() 

#添加周邊資源讀的權限
$role.Actions.Add("Microsoft.Storage/*/read") 
$role.Actions.Add("Microsoft.Network/*/read") 
$role.Actions.Add("Microsoft.Compute/*/read") 
$role.Actions.Add("Microsoft.Authorization/*/read") 
$role.Actions.Add("Microsoft.Resources/subscriptions/resourceGroups/read") 

#添加VM相關的操作權限
$role.Actions.Add("Microsoft.Compute/virtualMachines/start/action") 
$role.Actions.Add("Microsoft.Compute/virtualMachines/restart/action") 
$role.Actions.Add("Microsoft.Compute/virtualMachines/powerOff/action") 
$role.Actions.Add("Microsoft.Compute/virtualMachines/deallocate/action") 
$role.Actions.Add("Microsoft.Insights/alertRules/*") 

#把兩個Subscription加入到這個Role管理范圍中
$role.AssignableScopes.Clear() 
$role.AssignableScopes.Add("/subscriptions/$Sub1") 
$role.AssignableScopes.Add("/subscriptions/$Sub2") 

#添加角色
New-AzureRmRoleDefinition -Role $role
Name : Virtual Machine Operator
Id : 55aca895-61dc-4162-b7a6-fbab532d14a2
IsCustom : True
Description : Can monitor and start stop or restart virtual machines.
Actions : {Microsoft.Storage/*/read, Microsoft.Network/*/read, Microsoft.Compute/*/read, Microsoft.Compute/virtualMachines/start/action...}
NotActions : {}
AssignableScopes : {/subscriptions/$Sub1}

D 給用戶分配權限

New-AzureRmRoleAssignment -SignInName vmops@weiheng.partner.onmschina.cn -Scope /subscriptions/$Sub1/resourceGroups/hwnosql -RoleDefinitionName "Virtual Machine Operator" 
New-AzureRmRoleAssignment -SignInName vmops@weiheng.partner.onmschina.cn -Scope /subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsiwin -RoleDefinitionName "Virtual Machine Operator" 
New-AzureRmRoleAssignment -SignInName vmops@weiheng.partner.onmschina.cn -Scope /subscriptions/$Sub2 -RoleDefinitionName "Virtual Machine Operator"