创建自定义 Azure RBAC 角色以允许用户在 portal.azure.com 内交换插槽

Question

我正在尝试为开发人员创建一个自定义角色，以允许他们简单地交换我们各种 Web 应用程序上的插槽。这是我为完成此任务而创建的角色：

{
"Name": "Swap Role",
"Id": "",
"IsCustom": true,
"Description": "Lets developers perform slot swaps.",
"Actions": [
  "microsoft.web/sites/diagnostics/siteswap/read",
  "microsoft.web/sites/slots/diagnostics/siteswap/read",
  "microsoft.web/sites/slots/slotsswap/action",
  "microsoft.web/sites/slotsswap/action"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
  "/subscriptions/{subscriptionId-1}/resourceGroups/Development",
  "/subscriptions/{subscriptionId-2/resourceGroups/Development",
  "/subscriptions/{subscriptionId}/resourceGroups/Test",
  "/subscriptions/{subscriptionId-2/resourceGroups/Test",
  "/subscriptions/{subscriptionId}/resourceGroups/Production",
  "/subscriptions/{subscriptionId-2/resourceGroups/Production"
]
}

问题是，一旦我将此角色应用到我的测试用户，当我转到交换槽时，我的测试用户会在交换面板中看到错误 "You do not have swap permission"、"You do not have write permission"。

是否可以允许用户在不授予他们对 Web 应用程序的完全写入权限的情况下交换插槽？我缺少什么权限？

Answer 1

虽然我不知道您需要什么确切的权限，但根据错误文本，我会先将此添加到您已有的内容中：

Microsoft.Web/sites/slots/Write

这里是插槽 rbac 操作的完整列表：

Microsoft.Web/sites/applySlotConfig/Action
Microsoft.Web/sites/resetSlotConfig/Action
microsoft.web/sites/slots/analyzecustomhostname/read
Microsoft.Web/sites/slots/applySlotConfig/Action
Microsoft.Web/sites/slots/backup/Action
microsoft.web/sites/slots/backup/read
microsoft.web/sites/slots/backup/write
microsoft.web/sites/slots/backups/action
microsoft.web/sites/slots/backups/delete
microsoft.web/sites/slots/backups/list/action
Microsoft.Web/sites/slots/backups/Read
microsoft.web/sites/slots/backups/restore/action
microsoft.web/sites/slots/config/delete
Microsoft.Web/sites/slots/config/list/Action
Microsoft.Web/sites/slots/config/Read
Microsoft.Web/sites/slots/config/Write
microsoft.web/sites/slots/containerlogs/action
microsoft.web/sites/slots/containerlogs/download/action
microsoft.web/sites/slots/continuouswebjobs/delete
microsoft.web/sites/slots/continuouswebjobs/read
microsoft.web/sites/slots/continuouswebjobs/start/action
microsoft.web/sites/slots/continuouswebjobs/stop/action
Microsoft.Web/sites/slots/Delete
microsoft.web/sites/slots/deployments/delete
microsoft.web/sites/slots/deployments/log/read
microsoft.web/sites/slots/deployments/read
microsoft.web/sites/slots/deployments/write
microsoft.web/sites/slots/detectors/read
microsoft.web/sites/slots/diagnostics/analyses/execute/Action
microsoft.web/sites/slots/diagnostics/analyses/read
microsoft.web/sites/slots/diagnostics/aspnetcore/read
microsoft.web/sites/slots/diagnostics/autoheal/read
microsoft.web/sites/slots/diagnostics/deployment/read
microsoft.web/sites/slots/diagnostics/deployments/read
microsoft.web/sites/slots/diagnostics/detectors/execute/Action
microsoft.web/sites/slots/diagnostics/detectors/read
microsoft.web/sites/slots/diagnostics/frebanalysis/read
microsoft.web/sites/slots/diagnostics/loganalyzer/read
microsoft.web/sites/slots/diagnostics/read
microsoft.web/sites/slots/diagnostics/runtimeavailability/read
microsoft.web/sites/slots/diagnostics/servicehealth/read
microsoft.web/sites/slots/diagnostics/sitecpuanalysis/read
microsoft.web/sites/slots/diagnostics/sitecrashes/read
microsoft.web/sites/slots/diagnostics/sitelatency/read
microsoft.web/sites/slots/diagnostics/sitememoryanalysis/read
microsoft.web/sites/slots/diagnostics/siterestartsettingupdate/read
microsoft.web/sites/slots/diagnostics/siterestartuserinitiated/read
microsoft.web/sites/slots/diagnostics/siteswap/read
microsoft.web/sites/slots/diagnostics/threadcount/read
microsoft.web/sites/slots/diagnostics/workeravailability/read
microsoft.web/sites/slots/diagnostics/workerprocessrecycle/read
microsoft.web/sites/slots/domainownershipidentifiers/read
microsoft.web/sites/slots/functions/listsecrets/action
microsoft.web/sites/slots/functions/read
microsoft.web/sites/slots/hostnamebindings/delete
microsoft.web/sites/slots/hostnamebindings/read
microsoft.web/sites/slots/hostnamebindings/write
microsoft.web/sites/slots/hybridconnection/delete
microsoft.web/sites/slots/hybridconnection/read
microsoft.web/sites/slots/hybridconnection/write
microsoft.web/sites/slots/hybridconnectionnamespaces/relays/delete
microsoft.web/sites/slots/hybridconnectionnamespaces/relays/write
microsoft.web/sites/slots/hybridconnectionrelays/read
microsoft.web/sites/slots/instances/deployments/read
microsoft.web/sites/slots/instances/processes/delete
microsoft.web/sites/slots/instances/processes/read
microsoft.web/sites/slots/instances/read
microsoft.web/sites/slots/metricdefinitions/read
microsoft.web/sites/slots/metrics/read
microsoft.web/sites/slots/migratemysql/read
microsoft.web/sites/slots/networktrace/action
microsoft.web/sites/slots/networktraces/operationresults/read
microsoft.web/sites/slots/newpassword/action
microsoft.web/sites/slots/operationresults/read
microsoft.web/sites/slots/operations/read
microsoft.web/sites/slots/perfcounters/read
microsoft.web/sites/slots/phplogging/read
microsoft.web/sites/slots/premieraddons/delete
microsoft.web/sites/slots/premieraddons/read
microsoft.web/sites/slots/premieraddons/write
microsoft.web/sites/slots/processes/read
microsoft.web/sites/slots/publiccertificates/delete
microsoft.web/sites/slots/publiccertificates/read
microsoft.web/sites/slots/publiccertificates/write
Microsoft.Web/sites/slots/publish/Action
Microsoft.Web/sites/slots/publishxml/Action
Microsoft.Web/sites/slots/Read
microsoft.web/sites/slots/recover/action
Microsoft.Web/sites/slots/resetSlotConfig/Action
microsoft.web/sites/slots/resourcehealthmetadata/read
Microsoft.Web/sites/slots/restart/Action
microsoft.web/sites/slots/restore/read
microsoft.web/sites/slots/restore/write
microsoft.web/sites/slots/restorefrombackupblob/action
microsoft.web/sites/slots/restorefromdeletedwebapp/action
microsoft.web/sites/slots/restoresnapshot/action
microsoft.web/sites/slots/siteextensions/delete
microsoft.web/sites/slots/siteextensions/read
microsoft.web/sites/slots/siteextensions/write
Microsoft.Web/sites/slots/slotsdiffs/Action
Microsoft.Web/sites/slots/slotsswap/Action
microsoft.web/sites/slots/snapshots/read
Microsoft.Web/sites/slots/sourcecontrols/Delete
Microsoft.Web/sites/slots/sourcecontrols/Read
Microsoft.Web/sites/slots/sourcecontrols/Write
Microsoft.Web/sites/slots/start/Action
Microsoft.Web/sites/slots/stop/Action
microsoft.web/sites/slots/sync/action
microsoft.web/sites/slots/triggeredwebjobs/delete
microsoft.web/sites/slots/triggeredwebjobs/read
microsoft.web/sites/slots/triggeredwebjobs/run/action
microsoft.web/sites/slots/usages/read
microsoft.web/sites/slots/virtualnetworkconnections/delete
microsoft.web/sites/slots/virtualnetworkconnections/gateways/write
microsoft.web/sites/slots/virtualnetworkconnections/read
microsoft.web/sites/slots/virtualnetworkconnections/write
microsoft.web/sites/slots/webjobs/read
Microsoft.Web/sites/slots/Write
Microsoft.Web/sites/slotsdiffs/Action
Microsoft.Web/sites/slotsswap/Action

创建自定义 Azure RBAC 角色以允许用户在 portal.azure.com 内交换插槽

Creating Custom Azure RBAC Role to allow users to swap slots within portal.azure.com

azure

azure-web-app-service

azure-rbac