如何用Terraform创建覆盖Azure Service Bus队列与主题的差异化权限自定义角色

你可以通过单个Azure自定义角色实现需求，利用Azure RBAC的资源类型粒度权限控制，结合Terraform的变量与模块化能力消除代码重复。核心思路是在角色的权限定义中，针对队列和主题的资源路径分别指定不同的操作权限，无需拆分角色。

1. 基础实现：单角色配置示例 #

以下是直接编写的Terraform配置，通过azurerm_role_definition资源创建覆盖两类资源的自定义角色，区分队列与主题的权限：

# 定义变量：可灵活修改队列和主题的权限集合
variable "queue_permissions" {
  type    = list(string)
  default = [
    "Microsoft.ServiceBus/namespaces/queues/read",
    "Microsoft.ServiceBus/namespaces/queues/messages/send/action",
    "Microsoft.ServiceBus/namespaces/queues/messages/receive/action"
  ]
}

variable "topic_permissions" {
  type    = list(string)
  default = [
    "Microsoft.ServiceBus/namespaces/topics/read",
    "Microsoft.ServiceBus/namespaces/topics/messages/send/action"
  ]
}

# 创建自定义角色
resource "azurerm_role_definition" "service_bus_custom_role" {
  name        = "ServiceBusQueueTopicCustomRole"
  scope       = "/subscriptions/your-subscription-id" # 可指定为资源组或Service Bus命名空间级别
  description = "Custom role with different permissions for Service Bus queues and topics"

  permissions {
    actions = concat(var.queue_permissions, var.topic_permissions)
    not_actions = []
  }

  assignable_scopes = [
    "/subscriptions/your-subscription-id" # 与scope保持一致或更宽泛
  ]
}

关键说明： #

• 权限区分：通过权限字符串的资源路径后缀区分队列（queues）和主题（topics），比如Microsoft.ServiceBus/namespaces/queues/messages/send/action仅作用于队列，topics后缀仅作用于主题。
• 变量复用：将队列和主题的权限集合定义为变量，后续修改权限只需调整变量值，无需改动角色定义核心逻辑。
• 作用域控制：scope可指定为Service Bus命名空间级别（更精准）或资源组/订阅级别，根据实际需求调整。

2. 进阶：封装为Terraform模块 #

如果需要在多个项目或环境中复用该角色配置，可封装为Terraform模块，进一步提升可维护性：

模块目录结构 #

modules/service-bus-custom-role/
├── main.tf
├── variables.tf
└── outputs.tf

modules/service-bus-custom-role/variables.tf

variable "role_name" {
  type        = string
  description = "Name of the custom Service Bus role"
}

variable "role_description" {
  type        = string
  description = "Description of the custom role"
}

variable "scope" {
  type        = string
  description = "Scope where the role is defined (subscription/resource group/namespace ID)"
}

variable "queue_permissions" {
  type        = list(string)
  description = "List of permissions for Service Bus queues"
  default = [
    "Microsoft.ServiceBus/namespaces/queues/read",
    "Microsoft.ServiceBus/namespaces/queues/messages/send/action",
    "Microsoft.ServiceBus/namespaces/queues/messages/receive/action"
  ]
}

variable "topic_permissions" {
  type        = list(string)
  description = "List of permissions for Service Bus topics"
  default = [
    "Microsoft.ServiceBus/namespaces/topics/read",
    "Microsoft.ServiceBus/namespaces/topics/messages/send/action"
  ]
}

modules/service-bus-custom-role/main.tf

resource "azurerm_role_definition" "service_bus_role" {
  name        = var.role_name
  scope       = var.scope
  description = var.role_description

  permissions {
    actions = concat(var.queue_permissions, var.topic_permissions)
    not_actions = []
  }

  assignable_scopes = [var.scope]
}

modules/service-bus-custom-role/outputs.tf

output "role_id" {
  type        = string
  description = "ID of the created custom role"
  value       = azurerm_role_definition.service_bus_role.id
}

模块调用示例 #

在主项目中调用该模块：

module "service_bus_custom_role" {
  source = "./modules/service-bus-custom-role"

  role_name        = "Prod-ServiceBusQueueTopicRole"
  role_description = "Production role with queue receive + topic send permissions"
  scope            = "/subscriptions/your-subscription-id/resourceGroups/your-rg/providers/Microsoft.ServiceBus/namespaces/your-sb-namespace"

  # 可按需覆盖默认权限
  queue_permissions = [
    "Microsoft.ServiceBus/namespaces/queues/*",
    "Microsoft.ServiceBus/namespaces/queues/messages/*"
  ]
}

3. 验证与注意事项 #

• 角色创建后，可通过Azure门户或az role definition show命令查看权限详情，确认队列和主题的权限区分生效。
• 若需排除某些权限，可在permissions块中添加not_actions列表，比如禁止队列的删除操作："Microsoft.ServiceBus/namespaces/queues/delete"。
• 确保Terraform使用的Azure账号拥有Microsoft.Authorization/roleDefinitions/write权限，以创建自定义角色。

内容的提问来源于stack exchange，提问作者alightly alightly