如何使用ARM模板在AppInsight访问控制中添加角色

Question

我正在尝试使用ARM模板在AppInsight访问控制中添加角色分配。我能够使用ARM模板创建AppInsight，但无法在App Insight Access控件中添加角色分配。以下是使用ARM模板创建App Insight的代码

"resources": [
    {
        "type": "Microsoft.Insights/components",
        "kind": "web",
        "name": "[parameters('components_AppInsightPoc_name')]",
        "apiVersion": "2015-05-01",
        "location": "westus2",
        "scale": null,
        "properties": {
            "Application_Type": "web",
            "Flow_Type": "Redfield",
            "Request_Source": "IbizaAIExtension",
            "HockeyAppId": null,
            "SamplingPercentage": null
        }
    }
]

Answer 1

您可以使用此代码段将RBAC角色添加到资源：

{
    "type": "Microsoft.Insights/components/providers/roleAssignments",
    "apiVersion": "2017-05-01",
    "name": "[concat(parameters('components_AppInsightPoc_name'), '/Microsoft.Authorization/', guid('something'))]",
    "properties": {
        "roleDefinitionId": "[concat(subscription().Id, '/providers/Microsoft.Authorization/roleDefinitions/', 'role_guid')]",
        "principalId": "user_guid",
        "scope": "[resourceId('Microsoft.Insights/components', parameters('components_AppInsightPoc_name'))"
    }
}

你可以使用powershell获得角色指南：

Get-AzRoleDefinition

Answer 2

能够使用以下代码为App Insights添加RBAC

  "resources": [
    {
      "type": "Microsoft.Insights/components/providers/roleAssignments",
      "apiVersion": "2017-05-01",
      "name": "[concat(parameters('AppInsightName'),'/Microsoft.Authorization/',guid('AppInsightName'))]",
      "properties": {
        "roleDefinitionId": "[variables(parameters('builtInRoleType'))]",
        "principalId": "[parameters('principalId')]"
      }
    }
  ]