如何使用arm模板为资源组执行角色分配

Question

我试过了

{
  "apiVersion": "2016-07-01",
  "name": "[concat(resourceGroup().name,'/Microsoft.Authorization/',variables('principalId'))]",
  "type": "Microsoft.Authorization/roleAssignments",
  "properties": {
    "roleDefinitionId": "[variables('owner')]",
    "principalId": "[parameters('msi').principalId]",
    "scope": "[concat('/subscriptions/',subscription().subscriptionId,'/resourceGroups/',resourceGroup().name)]"
  }
},

但是它给出了以下错误

部署模板验证失败：“位于”1“和”3432“列的”Microsoft.Authorization/roleAssignments“类型的模板资源'sf-gateway/Microsoft.Authorization/5e60879d-b9c0-4e11-9548-9d92ed244eef‘段长度不正确。嵌套资源类型必须有与其资源名称相同的段数。根资源类型的段长度必须大于其资源名称。有关使用细节，请参阅https://aka.ms/arm-template/#resources。(代码: InvalidTemplate)

我不完全明白什么是需要改变的。

我想给出资源集团的主要所有权

Answer 1

我想给出资源集团的主要所有权

您可以从这个链接获得模板演示代码。如果使用VS创建模板，则可以直接从模板中获得模板。对我来说是正确的。

​

azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "principalId": {
      "type": "string",
      "metadata": {
        "description": "The principal to assign the role to"
      }      
    },
    "builtInRoleType": {
      "type": "string",
      "allowedValues": [
        "Owner",
        "Contributor",
        "Reader"
      ],
      "metadata": {
        "description": "Built-in role to assign"
      }      
    },
    "roleNameGuid": {
      "type": "string",
      "metadata": {
        "description": "A new GUID used to identify the role"
      }      
    }
  },
  "variables": {
    "Owner": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
    "Contributor": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
    "Reader": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
    "scope": "[resourceGroup().id]"
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2017-05-01",
      "name": "[parameters('roleNameGuid')]",
      "properties": {
        "roleDefinitionId": "[variables(parameters('builtInRoleType'))]",
        "principalId": "[parameters('principalId')]",
        "scope": "[variables('scope')]"
      }
    }
  ]
}

azuredeploy.parameters.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "principalId": {
      "value": "principalId"
    },
    "builtInRoleType": {
      "value": "Owner"
    },
    "roleNameGuid": {
      "value": "Guid name"
    }
  }
}

测试结果：

​

​

Answer 2

之所以会发生此错误，是因为名称有更多的段(即用斜杠标定的组件)，而不是类型，在这里更详细地解释了这一点：解决无效模板的错误。

有一个相关的讨论这里；如果您可以获得资源的GUID并将其传递给名称，那么它的段数将比类型少。