AuthorizationFailed - 在 Azure 中创建角色分配

Question

我不断得到授权失败当我尝试创建托管标识和分配角色分配时出错。 我已经在门户中完成了此操作，但在 terraform 中进行复制一直很痛苦。

# User Assigned Managed Identity
resource "azurerm_user_assigned_identity" "managed-id" {
  resource_group_name = var.resource_group
  location            = var.location
  name                = var.name
  tags                = var.tags
}

resource "azurerm_role_assignment" "rg" {
  scope                = data.azurerm_resource_group.rg.id
  role_definition_name = "Contributor"
  principal_id         = azurerm_user_assigned_identity.managed-id.id
}

resource "azurerm_role_assignment" "vnet" {
  scope                = data.azurerm_virtual_network.vnet.id
  role_definition_name = "Network Contributor"
  principal_id         = azurerm_user_assigned_identity.managed-id.id
}

resource "azurerm_role_assignment" "dns" {
  count                = "${var.create_dns_ra ? 1 : 0}"
  scope                = data.azurerm_subscription.sub.id
  role_definition_name = "Private DNS Zone Contributor"
  principal_id         = azurerm_user_assigned_identity.managed-id.id
}

应用地形后，这是错误的rg角色分配资源：

Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '9219bxxx-xxxx-xxxx-xxxx-xxxxxxxx' with object id '9219xxxx-xxxx-xxxx-xxxx-xxxxxxxx' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/4c4xxxx-xxxx-xxxx-xxxx-xxxxxxxx/resourceGroups/test-RG/providers/Microsoft.Authorization/roleAssignments/086bxxxx-xxxx-xxxx-xxxx-xxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials."

类似的错误虚拟网角色分配资源：

Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '9219bxxx-xxxx-xxxx-xxxx-xxxxxxxx' with object id '9219bxxx-xxxx-xxxx-xxxx-xxxxxxxx' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/4c4xxxx-xxxx-xxxx-xxxx-xxxxxxxx/resourceGroups/test-RG/providers/Microsoft.Network/virtualNetworks/test-RG-vnet/providers/Microsoft.Authorization/roleAssignments/55adxxxx-xxxx-xxxx-xxxx-xxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials."

我不知道我需要什么才能让它继续下去，但我很感激对此的任何建议或解决方案。谢谢

Answer 1

要创建角色分配，您需要分配用户访问管理员或者所有者包含此权限的服务主体的角色：“Microsoft.Authorization/roleAssignments/write”

我试图通过邮递员在我的环境中重现相同的内容并得到以下结果：

我使用以下查询为创建角色分配资源组并得到同样的错误如你所愿：

PUT https://management.azure.com/subscriptions/<subID>/resourceGroups/<rgname>/providers/Microsoft.Authorization/roleAssignments/xxxxxxxxxxxxxxxxxxxx?api-version=2022-04-01
{
  "properties": {
    "roleDefinitionId": "/subscriptions/<subID>/resourceGroups/<rgname>/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
    "principalId": "ca1xxx18-7561-4b98-987d-ee51xxxxd7"
  }
}

回复：

我有类似的错误当我尝试为创建角色分配时VNet太像下面：

PUT https://management.azure.com/subscriptions/<subID>/resourceGroups/<rgname>/providers/Microsoft.Network/virtualNetworks/srivnet/providers/Microsoft.Authorization/roleAssignments/xxxxxxxxxxxxxxxxxxxx?api-version=2022-04-01
{
  "properties": {
    "roleDefinitionId": "/subscriptions/<subID>/resourceGroups/<rgname>/providers/Microsoft.Network/virtualNetworks/srivnet/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
    "principalId": "ca1xxx18-7561-4b98-987d-ee51xxxxd7"
  }
}

回复：

到解决错误，我将 Owner 角色分配给订阅下的服务主体，如下所示：

分配该角色后，角色分配创建当我再次运行以下查询时在资源组上成功：

在您的情况下，尝试分配您的服务主体所有者订阅下的角色以解决该问题。

如果你觉得所有者角色更宽松，最好创建自定义 RBAC 角色“Microsoft.Authorization/roleAssignments/write”以下链接中建议的许可。

参考：Authorization failed when when writing a roleAssignment - Microsoft Q&A by AmanpreetSingh-MSFT