如何通过ARM模板为Automation Account托管身份分配订阅级多角色

问题根因 #

你当前模板中定义的角色分配资源类型为Microsoft.Automation/automationAccounts/providers/roleAssignments，该资源类型的作用范围被限定在自动化账号资源本身，因此权限仅会分配到自动化账号层级，无法达到订阅级效果。

核心修改点 #

1. 嵌套部署内的角色分配资源类型改为订阅级权限类型Microsoft.Authorization/roleAssignments
2. 为嵌套部署添加对自动化账号的依赖，确保系统托管身份生成完成后再执行权限分配
3. 调整角色分配的命名规则，符合订阅级资源全局唯一的要求

修改后的完整模板 #

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "AutomationAccountName": {
            "type": "string",
            "metadata": {
                "description": "Automation account name"
            }
        },
        "AutomationAccountProductTag": {
            "type": "string",
            "metadata": {
                "description": "Automation account Product tag"
            }
        },
        "AutomationAccountOwnerTag": {
            "type": "string",
            "metadata": {
                "description": "Automation account Owner tag"
            }
        },
        "WindowsRunbookName": {
            "type": "string",
            "metadata": {
                "description": "Runbook name for Windows instances"
            }
        },
        "RolesToAssignForMangedIdentity": {
            "type": "array",
            "defaultValue": [
                {
                    "name": "StorageQueueDataContributor",
                    "role": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]"
                },
                {
                    "name": "Contributor",
                    "role": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]"
                },
                {
                    "name": "StorageBlobDataContributor",
                    "role": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]"
                },
                {
                    "name": "VirtualMachineContributor",
                    "role": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]"
                }
            ]
        }
    },
    "variables": {
        "WindowsRunbookURL": "https://infraawsssmagentinstall.blob.core.windows.net/awsssmagentfiles/Runbook_install_ssm_windows.ps1",
        "LinuxRunbookURL": "",
        "RunbookRuntime": "5.1"
    },
    "resources": [
        {
            "type": "Microsoft.Automation/automationAccounts",
            "apiVersion": "2021-06-22",
            "name": "[parameters('AutomationAccountName')]",
            "location": "[resourceGroup().location]",
            "tags": {
                "Product": "[parameters('AutomationAccountProductTag')]",
                "Owner": "[parameters('AutomationAccountOwnerTag')]"
            },
            "identity": {
                "type": "SystemAssigned"
            },
            "properties": {
                "sku": {
                    "name": "Basic"
                }
            }
        },
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2021-04-01",
            "name": "[concat(parameters('RolesToAssignForMangedIdentity')[copyIndex()].name, '_' , guid(parameters('RolesToAssignForMangedIdentity')[copyIndex()].name)) ]",
            "copy": {
                "name": "RolesCopy",
                "count": "[length(parameters('RolesToAssignForMangedIdentity'))]"
            },
            "dependsOn": [
                "[resourceId('Microsoft.Automation/automationAccounts', parameters('AutomationAccountName'))]"
            ],
            "properties": {
                "mode": "Incremental",
                "expressionEvaluationOptions": {
                    "scope": "outer"
                },
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "resources": [
                         {
                            "type": "Microsoft.Authorization/roleAssignments",
                            "apiVersion": "2022-04-01",                            
                            "name": "[guid(parameters('RolesToAssignForMangedIdentity')[copyIndex()].name, parameters('AutomationAccountName'), subscription().subscriptionId)]",
                            "properties": {
                                "roleDefinitionId": "[parameters('RolesToAssignForMangedIdentity')[copyIndex()].role]",
                                "principalId": "[reference(resourceId('Microsoft.Automation/automationAccounts', parameters('AutomationAccountName')), '2021-06-22', 'full').identity.principalId]",
                                "principalType": "ServicePrincipal"
                            }                            
                        }
                    ]
                }
            }
        }
    ],
    "outputs": {}
}

注意事项 #

• 执行该模板部署的账号，必须持有订阅级别的所有者或用户访问管理员角色，否则没有权限完成订阅级角色分配操作
• 模板中保留了你原有所有参数、变量配置，未修改原有业务逻辑，仅调整了角色分配相关配置

内容的提问来源于stack exchange，提问作者Angus Szarpidrut