如何在使用 ARM 模板将 AD 角色分配给多个资源时使用循环

Question

我正在努力使用 ARM 模板将贡献者角色分配给多个 Azure 资源，例如 Azure Function App、Azure App Service 和 Application Insights 等。

为此，我使用了以下代码行：

        {
        "type": "Microsoft.Authorization/roleAssignments",
        "apiVersion": "2020-04-01-preview",
        "name": "[parameters('roleNameGuidForFunctionApp')]",
        "scope": "[concat('Microsoft.Web/sites/',parameters('functionAppName'))]",
        "dependsOn": [
            "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]"
        ],
        "properties": {
            "roleDefinitionId": "[variables('ContributorGroupRoleId')]",
            "principalId": "[parameters('principalId')]"
        }
    },
    {
        "type": "Microsoft.Authorization/roleAssignments",
        "apiVersion": "2020-04-01-preview",
        "name": "[parameters('roleNameGuidForAI')]",
        "scope": "[concat('microsoft.insights/components/',parameters('applicationInsightsName'))]",
        "dependsOn": [
            "[resourceId('microsoft.insights/components', parameters('applicationInsightsName'))]"
        ],
        "properties": {
            "roleDefinitionId": "[variables('ContributorGroupRoleId')]",
            "principalId": "[parameters('principalId')]"
        }
    }

上面的代码工作正常。但我想使用循环概念将贡献者角色分配给多个天蓝色资源。

所以，请教我怎么做

Answer 1

我已按照this 文档使用Resource iteration in ARM templates 的概念。

这是我的模板文件：

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "roleAssignments": {
        "type": "array",
        "metadata": {
            "description": "An array that contains objects with properties for assigning roles to multiple resources"
        }
    }
},
"variables": {
    "ContributorRoleId": "[resourceId('Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]"
},
"resources": [
    {
        "type": "Microsoft.Authorization/roleAssignments",
        "apiVersion": "2020-04-01-preview",
        "name": "[parameters('roleAssignments')[copyIndex('roleAssignments')].roleName]",
        "scope": "[concat(parameters('roleAssignments')[copyIndex('roleAssignments')].resourceProviderName,parameters('roleAssignments')[copyIndex('roleAssignments')].resourceName)]",

        "copy": {
            "name": "roleAssignments",
            "count": "[length(parameters('roleAssignments'))]"
        },
        "properties": {
            "roleDefinitionId": "[variables('ContributorRoleId')]",
            "principalId": "[parameters('roleAssignments')[copyIndex('roleAssignments')].principalId]"
        }
    }
],
"outputs": {}

}

这是我的参数文件：

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "roleAssignments": {
        "value": [
            {
                "roleName": "d37a0ae3-303e-4492-b4df-f1f11b2769f2",
                "principalId": "xxxxxxxxxxxxxxxxxxxxxxx",
                "resourceProviderName": "Microsoft.Web/sites/",
                "resourceName":"xxxxxxxxxxxxxxxxxxx"
            },
            {
                "roleName": "7be3e964-a62c-46f3-a1b8-ed355b85a11d",
                "principalId": "xxxxxxxxxxxxxxxxxx",
                "resourceProviderName": "Microsoft.Insights/components/",
                "resourceName":"xxxxxxxxxxxxxxxxxxx"
            }
        ]
    }
}

}