允许使用自定义 RBAC 角色访问开发工具

Question

我想允许某些开发团队成员访问 Azure Web 应用程序开发工具。

最好只有应用服务编辑器。我知道我可以授予“网站贡献者”，但我更愿意将范围缩小到仅此区域。

允许访问“config”并不起作用。下面是我的自定义角色 JSON。有没有办法仅添加对应用服务编辑器的访问权限，或者我必须授予网站贡献者？

    {
    "id": "/subscriptions/xxxxx/providers/Microsoft.Authorization/roleDefinitions/xxx",
    "properties": {
        "roleName": "xDevRole",
        "description": "Actions developers may perform",
        "assignableScopes": [
            "/subscriptions/xxxx",
            "/subscriptions/xxx"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read",
                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
                    "Microsoft.OperationalInsights/workspaces/search/action",
                    "Microsoft.Support/*",
                    "microsoft.web/sites/config/appsettings/read",
                    "Microsoft.Web/sites/config/Read",
                    "Microsoft.Web/sites/config/list/Action",
                    "microsoft.web/sites/config/web/appsettings/read",
                    "microsoft.web/sites/config/web/connectionstrings/read",
                    "microsoft.web/sites/config/snapshots/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Answer 1

请注意，应用服务编辑器依赖于多个底层 API 操作来检索和修改应用服务中需要

"Microsoft.Web/sites/*"

操作才能访问的配置设置、文件和目录。

为了缩小访问范围，收集您不希望用户执行的操作的操作，并将它们添加到自定义角色 JSON 的 “notActions” 部分作为替代方案：

{
    "properties": {
        "roleName": "AppServiceEditorRole",
        "description": "Custom role to allow access to App Service Editor, basic web app management, and configuration",
        "assignableScopes": [
            "/subscriptions/xxxxxxxxx"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Web/sites/*",
                    "Microsoft.Support/*",
                    "Microsoft.Web/serverFarms/join/action",
                    "Microsoft.Web/serverFarms/read",
                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
                    "Microsoft.OperationalInsights/workspaces/search/action",
                ],
                "notActions": [
                    "Microsoft.Web/sites/Delete",
                    "Microsoft.Web/sites/stop/Action",
                    "Microsoft.Web/sites/extensions/delete"
                ],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

向用户分配上述自定义角色将允许他们访问应用服务编辑器，但限制停止和删除 Web 应用程序及其扩展的访问权限，如下所示：

应用程序服务编辑器访问权限：

Stop

和

Delete

变灰：

删除扩展选项灰显：