自动化 - 容器应用程序中的托管身份是否有可能受到监控？

Question

只是想知道是否可以监视系统分配或用户分配的活动。 例如，如果系统手动指定“关闭”，则将触发电子邮件警报。

通过这种自动化，将监控用户更改应用程序的身份设置。 谢谢！

我想要获取如下所示的完美警报消息。

Answer 1

或者，您可以使用

PowerShell script

和自动化帐户来根据容器应用程序的身份状态触发警报。

为了通过身份验证发送邮件，请确保通过Stack链接向自动化帐户身份提供所需的权限，并分配Contributor角色以获取容器应用程序详细信息。

注意：在此方法中，您将每1小时收到一次邮件，或者您可以根据您的要求在自动化帐户中设置时间段来运行脚本

Connect-AzAccount -Identity
$subscriptionId = "Sub-ID"
Set-AzContext -SubscriptionId $subscriptionId

# Get all Container Apps in the resource group
$containerApps = Get-AzContainerApp

# Loop through each container app and check the identity status
foreach ($containerApp in $containerApps) {
    $emailSubject = ""
    $emailBody = ""

    # Retrieve the last modified details
    $lastModifiedBy = $containerApp.SystemDataLastModifiedBy
    $lastModifiedAt = $containerApp.SystemDataLastModifiedAt

    # Check if identity is enabled or not
    if ($containerApp.IdentityType -eq 'SystemAssigned') {
        # Identity is enabled
        $emailSubject = "Container app named $($containerApp.Name) Identity has been Enabled"
        $emailBody = "The container app: $($containerApp.Name) System identity has been enabled.`n"
        $emailBody += "Last Modified By: $lastModifiedBy`n"
        $emailBody += "Last Modified At: $lastModifiedAt"
    } elseif ($containerApp.IdentityType -eq 'None') {
        # Identity is disabled
        $emailSubject = "Container app named $($containerApp.Name) Identity has been Disabled"
        $emailBody = "The container app: $($containerApp.Name) System identity has been disabled.`n"
        $emailBody += "Last Modified By: $lastModifiedBy`n"
        $emailBody += "Last Modified At: $lastModifiedAt"
    } else {
        # Unknown identity type, just skip and continue to next app
        Write-Host "$($containerApp.Name) - Unknown identity type."
        continue
    }

    # Connect to Microsoft Graph
    Connect-MgGraph -Identity

    # Define sender and recipient email addresses
    $senderAddress = "Sender Email ID"
    $recipientAddress = "Receiver Email ID"

    # Define the email body type
    $type = "Text" 

    # Set up email parameters
    $params = @{
        Message         = @{
            Subject       = $emailSubject
            Body          = @{
                ContentType = $type
                Content     = $emailBody
            }
            ToRecipients  = @(
                @{
                    EmailAddress = @{
                        Address = $recipientAddress
                    }
                }
            )
        }
    }

    # Send the email
    Send-MgUserMail -UserId $senderAddress -BodyParameter $params
}

将 Runbook 附加到计划程序以根据重复时间段运行脚本。就我而言，我选择每 1 小时一次，因此脚本将每 1 小时运行一次，并且警报将触发

如果容器应用程序的系统管理身份发生任何更改，每 1 小时时间段就会收到警报以及详细信息

容器应用身份状态。

已发送包含容器应用程序详细信息的邮件

如果您想每秒触发自动化，您可以使用逻辑应用程序按照堆栈链接触发自动化帐户。