Azure基于角色的用户接入控制（RBAC）

RBAC是Role Based Access Control是基于角色的接入控制的简称。在Azure推出ARM以后，对Azure各种资源的管理粒度已经非常细致，使得RBAC成为可能。

通过RBAC可以非常方便的给不同的用户分配不同的资源的不同权限。

本文将以一个最通用的例子来介绍如何给一个用户分配相关的权限。

一需求

用户vmops只能对资源组1的虚拟机和资源组2的特定虚拟机进行开、关机或重启的动作。其他所有操作权限都没有。

二实现

1 创建用户

在Azure的老Portal上创建创建用户vmops@weiheng.partner.onmschina.cn

2 确定可以访问的资源

vmops这个用户可以操作的资源有：

Subscription 2中的Resource Group 1

Subscription 2中的Resource Group 2中的VM 1

Subscription 1中所有的VM

可以进行的操作有：

Start、restart、powerOff、Deallocate

3 通过PowerShell进行相关配置

A 首先需要得到VM可以操作的动作：

Get-AzureRMProviderOperation Microsoft.Compute/virtualMachines/* | ft operation
WARNING: The output object type of this cmdlet will be modified in a future release.
Operation
---------
Microsoft.Compute/virtualMachines/read
Microsoft.Compute/virtualMachines/write
Microsoft.Compute/virtualMachines/delete
Microsoft.Compute/virtualMachines/start/action
Microsoft.Compute/virtualMachines/powerOff/action
Microsoft.Compute/virtualMachines/redeploy/action
Microsoft.Compute/virtualMachines/restart/action
Microsoft.Compute/virtualMachines/deallocate/action
Microsoft.Compute/virtualMachines/generalize/action
Microsoft.Compute/virtualMachines/capture/action
Microsoft.Compute/virtualMachines/vmSizes/read
Microsoft.Compute/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachines/extensions/read
Microsoft.Compute/virtualMachines/extensions/write
Microsoft.Compute/virtualMachines/extensions/delete

B 获取三种资源的ID

1 subscription ID

Get-AzureRmSubscription | ft SubscriptionID
SubscriptionId
--------------
$Sub1
$Sub2

2 Subscription 2 中的Resouce Group ID

Get-AzureRmResourceGroup | ft ResourceId
ResourceId
----------
/subscriptions/$Sub1/resourceGroups/hwnosql
/subscriptions/$Sub1/resourceGroups/hwiscsi

3 hwiscsi中vm1的Id

get-azurermvm -ResourceGroupName hwiscsi | ft id
Id
/subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsi01
/subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsi02
/subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsiwin

C 定义新的Role

首先获得已有的Role的类型

Get-AzureRmRoleDefinition | ft name
Name
----
API Management Service Contributor
Application Insights Component Contributor
BizTalk Contributor
Classic Network Contributor
Classic Storage Account Contributor
Classic Virtual Machine Contributor
ClearDB MySQL DB Contributor
Contributor
Data Factory Contributor
DocumentDB Account Contributor
Intelligent Systems Account Contributor
Network Contributor
New Relic APM Account Contributor
Owner
Reader
Redis Cache Contributor
Scheduler Job Collections Contributor
Search Service Contributor
SQL DB Contributor
SQL Security Manager
SQL Server Contributor
Storage Account Contributor
User Access Administrator
Virtual Machine Contributor
Web Plan Contributor
Website Contributor

本方案通过Virtual Machine Contributor的模板修改。

#获取"Virtual Machine Contributor"配置
$role = Get-AzureRmRoleDefinition "Virtual Machine Contributor" 
$role.Id = $null 
$role.Name = "Virtual Machine Operator" 
$role.Description = "Can monitor and start stop or restart virtual machines." 
$role.Actions.Clear() 

#添加周边资源读的权限
$role.Actions.Add("Microsoft.Storage/*/read") 
$role.Actions.Add("Microsoft.Network/*/read") 
$role.Actions.Add("Microsoft.Compute/*/read") 
$role.Actions.Add("Microsoft.Authorization/*/read") 
$role.Actions.Add("Microsoft.Resources/subscriptions/resourceGroups/read") 

#添加VM相关的操作权限
$role.Actions.Add("Microsoft.Compute/virtualMachines/start/action") 
$role.Actions.Add("Microsoft.Compute/virtualMachines/restart/action") 
$role.Actions.Add("Microsoft.Compute/virtualMachines/powerOff/action") 
$role.Actions.Add("Microsoft.Compute/virtualMachines/deallocate/action") 
$role.Actions.Add("Microsoft.Insights/alertRules/*") 

#把两个Subscription加入到这个Role管理范围中
$role.AssignableScopes.Clear() 
$role.AssignableScopes.Add("/subscriptions/$Sub1") 
$role.AssignableScopes.Add("/subscriptions/$Sub2") 

#添加角色
New-AzureRmRoleDefinition -Role $role
Name : Virtual Machine Operator
Id : 55aca895-61dc-4162-b7a6-fbab532d14a2
IsCustom : True
Description : Can monitor and start stop or restart virtual machines.
Actions : {Microsoft.Storage/*/read, Microsoft.Network/*/read, Microsoft.Compute/*/read, Microsoft.Compute/virtualMachines/start/action...}
NotActions : {}
AssignableScopes : {/subscriptions/$Sub1}

D 给用户分配权限

New-AzureRmRoleAssignment -SignInName vmops@weiheng.partner.onmschina.cn -Scope /subscriptions/$Sub1/resourceGroups/hwnosql -RoleDefinitionName "Virtual Machine Operator" 
New-AzureRmRoleAssignment -SignInName vmops@weiheng.partner.onmschina.cn -Scope /subscriptions/$Sub1/resourceGroups/hwiscsi/providers/Microsoft.Compute/virtualMachines/hwiscsiwin -RoleDefinitionName "Virtual Machine Operator" 
New-AzureRmRoleAssignment -SignInName vmops@weiheng.partner.onmschina.cn -Scope /subscriptions/$Sub2 -RoleDefinitionName "Virtual Machine Operator"