如何在Bicep模板中为Azure自动化账户托管身份分配Azure角色

核心问题解决思路 #

Bicep同模板内的资源属性无需通过输出转参数的方式传递，直接通过资源声明的符号名+属性路径即可直接引用。模板output字段的作用是将值返回给模板外的调用方（比如父模板、部署脚本），同模板内的资源只要完成声明，后续资源块可以直接读取它的所有属性值。

针对托管标识角色分配的需求，只需要在角色分配资源块里直接引用自动化账户的identity.principalId属性，同时添加依赖确保自动化账户先部署完成即可。

具体实现要点 #

• 直接在角色分配的properties.principalId字段填写autaccount.identity.principalId，无需手动从门户获取值
• 给角色分配资源添加dependsOn: [autaccount]，确保托管标识生成后再执行角色分配
• 可根据需求调整内置角色的定义ID，常用内置角色的ID如下：
  • 所有者(Owner)：8e3af657-a8ff-443c-a75c-2fe8c4bcb635
  • 参与者(Contributor)：b24988ac-6180-42a0-ab88-20f7382dd24c
  • 读取者(Reader)：acdd72a7-3385-48ef-bd42-f606fba81ae7
• 若需要将角色分配到订阅级而非当前资源组，可在角色分配资源块中添加scope: subscription()属性

完整可运行Bicep模板 #

@description('指定所有资源的部署区域')
param location string = resourceGroup().location

var accountname = 'SnapshotMgmtv11'
var runbookname = 'Create11'
var schedulename = 'SnapshotHourly11'

// 自动化账户资源声明
resource autaccount 'Microsoft.Automation/automationAccounts@2021-06-22' = {
  name: accountname
  location: location
  tags: {
    test: 'true'
  }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    disableLocalAuth: false
    encryption: {
      identity: {
      }
      keySource: 'Microsoft.Automation'
    }
    publicNetworkAccess: false
    sku: {
      capacity: null
      family: null
      name: 'Basic'
    }
  }
}

// Runbook资源声明
resource runbook1 'Microsoft.Automation/automationAccounts/runbooks@2019-06-01' = {
  parent: autaccount
  name: runbookname
  location: location
  properties: {
    runbookType: 'PowerShell'
    logVerbose: false
    logProgress: false
    logActivityTrace: 0
    publishContentLink: {
      uri: 'https://raw.githubusercontent.com/..................'
    }
  }
}

// 调度计划资源声明
resource schedule1 'Microsoft.Automation/automationAccounts/schedules@2020-01-13-preview' = {
  parent: autaccount
  name: schedulename
  properties: {
    startTime: '08:30'
    expiryTime: ''
    interval: 1
    frequency: 'Hour'
    timeZone: 'Europe/Riga'
  }
}

// Runbook与调度关联
resource link 'Microsoft.Automation/automationAccounts/jobSchedules@2020-01-13-preview' = {
  name: guid('riniv011')
  parent: autaccount
  dependsOn: [
    runbook1
  ]
  properties: {
    parameters: {}
    runbook: {
      name: runbookname
    }
    schedule: {
      name: schedulename
    }
  }
}

@description('角色分配的唯一GUID标识')
param roleNameGuid string = newGuid()

// 内置角色定义，可按需注释切换
//var Owner = '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635'
var Contributor = '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
//var Reader = '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7'

// 角色分配资源声明
resource roleassignment 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = {
  name: roleNameGuid
  dependsOn: [
    autaccount
  ]
  properties: {
    principalId: autaccount.identity.principalId
    roleDefinitionId: Contributor
  }
}

内容的提问来源于stack exchange，提问作者Rini