管理组级别的RoleAssignment的ARM模板

Question

我正在尝试创建一个arm模板，该模板将RBAC角色分配给管理组级别的组。我可以通过命令行界面和PowerShell来实现，但是不能通过ARM模板来实现

{
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "roleDefinitionId": {
            "type": "string",
            "defaultValue": "xxxx",
            "metadata": {
                "description": "roleDefinition for the assignment - default is reader"
            }
        }
    },
    "variables": {
        "roleAssignmentName": "[guid('/', variables('xxx'), parameters('roleDefinitionId'))]"
    },
    "resources": [
        {
            "name": "[variables('roleAssignmentName')]",
            "type": "Microsoft.Authorization/roleAssignments",
            "apiVersion": "2020-04-01-preview",
            "scope": "/providers/Microsoft.Management/managementGroups/xxxx",
            "properties": {
                "mode": "Incremental",
                "roleDefinitionId": "xxx",
                "principalId": "xxxx",
                "principalType": "Group"
            }
        }
    ]
}

有没有人知道是否支持MGMT组，如果是，我做错了什么？

这是ARM角色分配https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-template的官方文档，它显示了如何为Subs和资源组执行此操作

Answer 1

从资源定义中删除作用域属性...

TLDR；roleAssignments只能部署在它们被分配到的作用域中，因此该属性是无关的。此外，作用域属性不适用于managementGroup扩展资源(令人困惑，我知道)，这只是一个时间点。scope属性通常用于将资源定位到不同的作用域(即与模板部署本身不同)，但是由于roleAssignments不能被重定目标，所以您不需要它，在这种情况下它会给您带来问题。

下面是我的示例(注意，我没有principalType属性，所以它使用默认值)：

{
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
      "principalId": {
        "type": "string",
        "metadata": {
          "description": "principalId if the user that will be given contributor access to the resourceGroup"
        }
      },
      "roleDefinitionId": {
        "type": "string",
        "defaultValue": "b24988ac-6180-42a0-ab88-20f7382dd24c",
        "metadata": {
          "description": "roleDefinition for the assignment - default is contributor"
        }
      },
      "managementGroupName": {
        "type": "string",
        "metadata": {
          "description": "Name of the managementGroup for the roleAssignment"
        }
      }
    },
    "variables": {
      // this creates an idempotent GUID for the role assignment
      "roleAssignmentName": "[guid(parameters('managementGroupName'), parameters('principalId'), parameters('roleDefinitionId'))]"
     },
    "resources": [
      {
        "type": "Microsoft.Authorization/roleAssignments",
        "apiVersion": "2020-04-01-preview",
        "name": "[variables('roleAssignmentName')]",
        "properties": {
          "roleDefinitionId": "[tenantResourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))]",
          "principalId": "[parameters('principalId')]"
        }
      }
    ]
  }