请求修改Azure PowerShell脚本以获取订阅内资源及角色分配详情

$tenantId = "xxxxxxx"
$subscriptionId = "xxxxxxxx"

# 登录Azure
Connect-AzAccount -Tenant $tenantId -Subscription $subscriptionId -UseDeviceAuthentication

# 获取所有层级的角色分配
function Get-FullRoleAssignments {
    [OutputType([System.Collections.ArrayList])]
    param(
        [string]$SubscriptionId
    )

    Write-Host "`n> 正在获取订阅级角色分配..." -ForegroundColor Green
    $roleAssignments = [System.Collections.ArrayList]::new()

    # 1. 获取订阅级角色分配
    $subAssignments = Get-AzRoleAssignment -Scope "/subscriptions/$SubscriptionId" -ErrorAction SilentlyContinue
    foreach ($role in $subAssignments) {
        $roleAssignments.Add([PSCustomObject]@{
            "层级" = "订阅"
            "资源组名称" = $null
            "资源名称" = $null
            "显示名称" = $role.DisplayName ?? "N/A"
            "登录名称" = $role.SignInName ?? "N/A"
            "对象类型" = $role.ObjectType ?? "N/A"
            "对象ID" = $role.ObjectId ?? "N/A"
            "角色名称" = $role.RoleDefinitionName ?? "N/A"
            "角色定义ID" = $role.RoleDefinitionId ?? "N/A"
            "作用域" = $role.Scope ?? "N/A"
            "描述" = $role.Description ?? "N/A"
            "可委派" = $role.CanDelegate ?? "N/A"
        }) | Out-Null
    }

    # 2. 获取所有资源组及其角色分配
    $resourceGroups = Get-AzResourceGroup -ErrorAction SilentlyContinue
    foreach ($rg in $resourceGroups) {
        Write-Host "`n> 正在获取资源组 [$($rg.ResourceGroupName)] 的角色分配..." -ForegroundColor Green
        $rgAssignments = Get-AzRoleAssignment -Scope $rg.ResourceId -ErrorAction SilentlyContinue
        foreach ($role in $rgAssignments) {
            $roleAssignments.Add([PSCustomObject]@{
                "层级" = "资源组"
                "资源组名称" = $rg.ResourceGroupName ?? "N/A"
                "资源名称" = $null
                "显示名称" = $role.DisplayName ?? "N/A"
                "登录名称" = $role.SignInName ?? "N/A"
                "对象类型" = $role.ObjectType ?? "N/A"
                "对象ID" = $role.ObjectId ?? "N/A"
                "角色名称" = $role.RoleDefinitionName ?? "N/A"
                "角色定义ID" = $role.RoleDefinitionId ?? "N/A"
                "作用域" = $role.Scope ?? "N/A"
                "描述" = $role.Description ?? "N/A"
                "可委派" = $role.CanDelegate ?? "N/A"
            }) | Out-Null
        }

        # 3. 获取资源组下所有资源的角色分配
        $resources = Get-AzResource -ResourceGroupName $rg.ResourceGroupName -ErrorAction SilentlyContinue
        foreach ($res in $resources) {
            Write-Host ">> 正在获取资源 [$($res.Name)] 的角色分配..." -ForegroundColor Cyan
            $resAssignments = Get-AzRoleAssignment -Scope $res.ResourceId -ErrorAction SilentlyContinue
            foreach ($role in $resAssignments) {
                $roleAssignments.Add([PSCustomObject]@{
                    "层级" = "资源"
                    "资源组名称" = $rg.ResourceGroupName ?? "N/A"
                    "资源名称" = $res.Name ?? "N/A"
                    "显示名称" = $role.DisplayName ?? "N/A"
                    "登录名称" = $role.SignInName ?? "N/A"
                    "对象类型" = $role.ObjectType ?? "N/A"
                    "对象ID" = $role.ObjectId ?? "N/A"
                    "角色名称" = $role.RoleDefinitionName ?? "N/A"
                    "角色定义ID" = $role.RoleDefinitionId ?? "N/A"
                    "作用域" = $role.Scope ?? "N/A"
                    "描述" = $role.Description ?? "N/A"
                    "可委派" = $role.CanDelegate ?? "N/A"
                }) | Out-Null
            }
        }
    }

    return $roleAssignments
}

# 调用函数获取所有角色分配
$allRoleAssignments = Get-FullRoleAssignments -SubscriptionId $subscriptionId

# 导出到CSV
$allRoleAssignments | Export-Csv -Path "FullRoleAssignments.csv" -NoTypeInformation -Encoding UTF8

Write-Host "`n角色分配报告已生成并保存到 FullRoleAssignments.csv" -ForegroundColor Green

关键修改点 #

• 覆盖全层级权限：原脚本仅获取订阅级角色分配，修改后遍历订阅、资源组、资源三个层级的权限分配，确保无遗漏
• 移除全局变量：改用函数返回值传递数据，避免全局变量带来的潜在冲突
• 空值兜底处理：用?? "N/A"为所有可能为空的字段设置默认值，避免导出CSV时出现异常
• 容错机制：添加-ErrorAction SilentlyContinue跳过无权限访问的资源/资源组，保证脚本持续执行
• 简化对象创建：用[PSCustomObject]替代New-Object+Add-Member写法，代码更简洁易维护
• 新增分类字段：添加「层级」「资源组名称」「资源名称」字段，方便在CSV中快速筛选不同层级的权限分配

使用注意 #

• 执行账号需拥有Reader或Role Based Access Control Administrator权限，否则可能无法读取部分角色分配
• 脚本执行时长取决于订阅内资源数量，资源较多时需耐心等待
• 导出的CSV使用UTF8编码，避免中文乱码

内容的提问来源于stack exchange，提问作者Meghana