更新Azure自定义角色定义时遇Microsoft.Cdn Purge动作不匹配错误

问题场景 #

在DevOps流水线中执行以下PowerShell命令更新Azure自定义角色定义：

$roleDef = az role definition update --role-definition $r.FullName | ConvertFrom-Json

变量$r指向的角色定义文件内容如下：

{
    "Name": "DevOps Pipeline",
    "Description": "用于部署Web应用代码，但不允许创建资源",
    "AssignableScopes": [
        "/subscriptions/sub-id-here"
    ],
    "Actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.ContainerRegistry/registries/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Insights/components/*",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*",
        "Microsoft.Web/certificates/*",
        "Microsoft.Web/listSitesAssignedToHostName/read",
        "Microsoft.Web/serverFarms/join/action",
        "Microsoft.Web/serverFarms/read",
        "Microsoft.Web/sites/*",
        "Microsoft.Storage/storageAccounts/read",
        "Microsoft.Storage/storageAccounts/listkeys/action",
        "Microsoft.Cdn/profiles/endpoints/Purge/action",
        "Microsoft.Web/connections/write",
        "Microsoft.Logic/workflows/write"
    ],
    "NotActions": [],
    "DataActions": [
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/deleteBlobVersion/action",
        "Microsoft.AppConfiguration/configurationStores/*/read",
        "Microsoft.AppConfiguration/configurationStores/*/write",
        "Microsoft.AppConfiguration/configurationStores/*/delete"
    ],
    "NotDataActions": []
}

执行命令时抛出异常：

ERROR: 'Microsoft.Cdn/profiles/endpoints/Purge/action' does not match any of the actions supported by the providers.

问题原因 #

Azure RBAC的操作名称（Action）区分大小写，原配置中Purge使用了大写首字母，而CDN资源提供程序支持的正确操作名称为小写的purge。

修复步骤 #

1. 打开角色定义JSON文件，定位到Actions数组中的"Microsoft.Cdn/profiles/endpoints/Purge/action"
2. 将其修改为："Microsoft.Cdn/profiles/endpoints/purge/action"
3. 重新执行角色定义更新命令即可完成修复

内容的提问来源于stack exchange，提问作者Rob Bowman