通过自定义RBAC角色授予Azure Web App开发工具访问权限

可以仅为开发人员开放App Service Editor的访问权限，完全不需要授予Website Contributor角色，只需在你的自定义角色配置中补充App Service Editor所需的特定权限即可。

需要添加的关键权限 #

要让用户正常使用App Service Editor，需在自定义角色的actions数组中添加以下权限：

• Microsoft.Web/sites/extensions/run/action：这是启动和操作App Service Editor的核心权限
• Microsoft.Web/sites/siteextensions/read：用于查看App Service Editor扩展的基础信息（你的配置中已有*/read，理论上已包含该权限，但明确添加可避免权限覆盖问题）

修改后的自定义角色JSON配置 #

{
    "id": "/subscriptions/xxxxx/providers/Microsoft.Authorization/roleDefinitions/xxx",
    "properties": {
        "roleName": "xDevRole",
        "description": "Actions developers may perform",
        "assignableScopes": [
            "/subscriptions/xxxx",
            "/subscriptions/xxx"
        ],
        "permissions": [
            {
                "actions": [
                    "*/read",
                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
                    "Microsoft.OperationalInsights/workspaces/search/action",
                    "Microsoft.Support/*",
                    "microsoft.web/sites/config/appsettings/read",
                    "Microsoft.Web/sites/config/Read",
                    "Microsoft.Web/sites/config/list/Action",
                    "microsoft.web/sites/config/web/appsettings/read",
                    "microsoft.web/sites/config/web/connectionstrings/read",
                    "microsoft.web/sites/config/snapshots/read",
                    "Microsoft.Web/sites/extensions/run/action",
                    "Microsoft.Web/sites/siteextensions/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

权限说明 #

• 保留原有的*/read及各类配置读取权限，确保用户能查看Web App的基础信息和配置
• 新增的extensions/run/action权限仅允许用户启动和使用App Service Editor，不会赋予修改Web App核心配置、部署代码等额外权限，严格遵循最小权限原则，比Website Contributor的权限范围小很多

内容的提问来源于stack exchange，提问作者Damo