如何通过Terraform配置Azure Sentinel的Playbook权限？

现有部署代码 #

你已通过以下Terraform代码完成Log Analytics工作区和Azure Sentinel的部署：

resource "azurerm_log_analytics_workspace" "log_analytics_workspace" {
  name                = "log-test-permissions"
  location            = "xxx"
  resource_group_name = "xxx"
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

resource "azurerm_log_analytics_solution" "sentinel" {
  solution_name         = "SecurityInsights"
  location              = "xxx"
  resource_group_name   = "xxx"
  workspace_resource_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
  workspace_name        = azurerm_log_analytics_workspace.log_analytics_workspace.name

  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/SecurityInsights"
  }

  depends_on = [azurerm_log_analytics_workspace.log_analytics_workspace]
}

需求说明 #

需要通过Terraform实现手动配置Playbook权限的流程：给Azure Sentinel授权访问包含Playbook的特定资源组，对应手动操作里的「配置权限→添加资源组」步骤。

Terraform实现方案 #

手动配置Playbook权限的本质是给Azure Sentinel的系统托管标识授予目标资源组的Logic App Contributor角色权限。以下是具体实现：

1. 引用目标资源组（可选） #

如果目标资源组不是当前Terraform栈部署的，可通过数据资源引用：

data "azurerm_resource_group" "playbook_rg" {
  name = "你的Playbook所在资源组名称"
}

2. 添加角色分配 #

给Sentinel的托管标识分配目标资源组的权限：

resource "azurerm_role_assignment" "sentinel_playbook_rg_access" {
  scope                = data.azurerm_resource_group.playbook_rg.id # 也可直接写资源组完整ID："/subscriptions/xxx/resourceGroups/xxx"
  role_definition_name = "Logic App Contributor"
  principal_id         = azurerm_log_analytics_solution.sentinel.identity[0].principal_id

  # 确保Sentinel部署完成后再分配权限
  depends_on = [azurerm_log_analytics_solution.sentinel]
}

完整整合代码 #

# 现有Log Analytics工作区部署
resource "azurerm_log_analytics_workspace" "log_analytics_workspace" {
  name                = "log-test-permissions"
  location            = "xxx"
  resource_group_name = "xxx"
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

# 现有Azure Sentinel部署
resource "azurerm_log_analytics_solution" "sentinel" {
  solution_name         = "SecurityInsights"
  location              = "xxx"
  resource_group_name   = "xxx"
  workspace_resource_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
  workspace_name        = azurerm_log_analytics_workspace.log_analytics_workspace.name

  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/SecurityInsights"
  }

  depends_on = [azurerm_log_analytics_workspace.log_analytics_workspace]
}

# 引用Playbook所在资源组
data "azurerm_resource_group" "playbook_rg" {
  name = "playbook-resource-group" # 替换为实际资源组名称
}

# 给Sentinel分配资源组权限
resource "azurerm_role_assignment" "sentinel_playbook_rg_access" {
  scope                = data.azurerm_resource_group.playbook_rg.id
  role_definition_name = "Logic App Contributor"
  principal_id         = azurerm_log_analytics_solution.sentinel.identity[0].principal_id

  depends_on = [azurerm_log_analytics_solution.sentinel]
}

补充说明 #

• 该操作与手动添加资源组权限的效果完全一致，Sentinel通过此权限可触发、管理目标资源组内的Playbook。
• 若需给多个资源组配置权限，复制azurerm_role_assignment块并修改scope即可。

内容的提问来源于stack exchange，提问作者dev007