Поделиться через

Add or edit Azure role assignment conditions using the REST API

  • Статья

Условие назначения ролей Azure — это дополнительная проверка, которую можно дополнительно добавить в назначение роли, чтобы обеспечить более точное управление доступом. Например, можно добавить условие, требующее, чтобы у объекта был конкретный тег, чтобы его можно было прочитать. This article describes how to add, edit, list, or delete conditions for your role assignments using the REST API.

Предпосылки

Необходимо использовать следующие версии:

  • 2020-03-01-preview or later
  • 2020-04-01-preview или более поздней версии, если вы хотите использовать свойство description для назначения ролей
  • 2022-04-01 является первой стабильной версией

For more information about the prerequisites to add or edit role assignment conditions, see Conditions prerequisites.

Добавить условие

To add a role assignment condition, use the Role Assignments - Create REST API. Role Assignments - Create includes the following parameters related to conditions.

Параметр Тип Описание
condition Струна Условие, при котором пользователю может быть предоставлено разрешение.
conditionVersion Струна Version of the condition syntax. Если condition задано без conditionVersion, версия устанавливается на значение по умолчанию 2.0.

Use the following request and body:

PUT https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}?api-version=2022-04-01

{
    "properties": {
        "roleDefinitionId": "/{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}",
        "principalId": "{principalId}",
        "condition": "{condition}",
        "conditionVersion": "2.0",
        "description": "{description}"
    }
}

The following example shows how to assign the Storage Blob Data Reader role with a condition. The condition checks whether container name equals 'blobs-example-container'.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}?api-version=2022-04-01

{
    "properties": {
        "roleDefinitionId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
        "principalId": "{principalId}",
        "condition": "((!(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'})) OR (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'blobs-example-container'))",
        "conditionVersion": "2.0",
        "description": "Read access if container name equals blobs-example-container"
    }
}

Ниже приведен пример выходных данных:

{
    "properties": {
        "roleDefinitionId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
        "principalId": "{principalId}",
        "principalType": "User",
        "scope": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}",
        "condition": "((!(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'})) OR (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'blobs-example-container'))",
        "conditionVersion": "2.0",
        "createdOn": "2022-07-20T06:20:44.0205560Z",
        "updatedOn": "2022-07-20T06:20:44.2955371Z",
        "createdBy": null,
        "updatedBy": "{updatedById}",
        "delegatedManagedIdentityResourceId": null,
        "description": "Read access if container name equals blobs-example-container"
    },
    "id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}",
    "type": "Microsoft.Authorization/roleAssignments",
    "name": "{roleAssignmentId}"
}

Изменение условия

To edit an existing role assignment condition, use the same Role Assignments - Create REST API as you used to add the role assignment condition. The following shows an example JSON where condition and description are updated. Только свойства condition, conditionVersion и description можно изменять. You must specify the other properties to match the existing role assignment.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}?api-version=2022-04-01

{
    "properties": {
        "roleDefinitionId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
        "principalId": "{principalId}",
        "condition": "((!(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'})) OR (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'blobs-example-container' OR @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'blobs-example-container2'))",
        "conditionVersion": "2.0",
        "description": "Read access if container name equals blobs-example-container or blobs-example-container2"
    }
}

Перечислите условие

To list a role assignment condition, use the Role Assignments Get or List REST API. For more information, see List Azure role assignments using the REST API.

Удаление условия

To delete a role assignment condition, edit the role assignment condition and set both the condition and condition version to either an empty string or null.

Alternatively, if you want to delete both the role assignment and the condition, you can use the Role Assignments - Delete API. Дополнительные сведения см. в статье Удаление назначений ролей Azure.

Дальнейшие действия