你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

Jit Network Access Policies - List By Resource Group And Region

Service:

Defender for Cloud

API Version:

2020-01-01

使用订阅、位置的实时访问控制来保护资源的策略

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies?api-version=2020-01-01

URI 参数

名称	在	必需	类型	说明
ascLocation	path	True	string	ASC 存储订阅数据的位置。 可以从获取位置检索
resourceGroupName	path	True	string	用户订阅中的资源组的名称。 此名称不区分大小写。 Regex pattern: ^[-\w\._\(\)]+$
subscriptionId	path	True	string	Azure 订阅 ID Regex pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
api-version	query	True	string	操作的 API 版本

响应

名称	类型	说明
200 OK	JitNetworkAccessPoliciesList	确定
Other Status Codes	CloudError	描述操作失败原因的错误响应。

安全性

azure_auth

Azure Active Directory OAuth2 流

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

名称	说明
user_impersonation	模拟用户帐户

示例

Get JIT network access policies on a resource group from a security data location

Sample Request

HTTP

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Security/locations/westeurope/jitNetworkAccessPolicies?api-version=2020-01-01

Java

/**
 * Samples for JitNetworkAccessPolicies ListByResourceGroupAndRegion.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/
     * GetJitNetworkAccessPoliciesResourceGroupLocation_example.json
     */
    /**
     * Sample code: Get JIT network access policies on a resource group from a security data location.
     * 
     * @param manager Entry point to SecurityManager.
     */
    public static void getJITNetworkAccessPoliciesOnAResourceGroupFromASecurityDataLocation(
        com.azure.resourcemanager.security.SecurityManager manager) {
        manager.jitNetworkAccessPolicies().listByResourceGroupAndRegion("myRg1", "westeurope",
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesResourceGroupLocation_example.json
func ExampleJitNetworkAccessPoliciesClient_NewListByResourceGroupAndRegionPager() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewJitNetworkAccessPoliciesClient().NewListByResourceGroupAndRegionPager("myRg1", "westeurope", nil)
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.JitNetworkAccessPoliciesList = armsecurity.JitNetworkAccessPoliciesList{
		// 	Value: []*armsecurity.JitNetworkAccessPolicy{
		// 		{
		// 			Kind: to.Ptr("Basic"),
		// 			Location: to.Ptr("westeurope"),
		// 			Name: to.Ptr("default"),
		// 			Type: to.Ptr("Microsoft.Security/locations/jitNetworkAccessPolicies"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Security/locations/westeurope/jitNetworkAccessPolicies/default"),
		// 			Properties: &armsecurity.JitNetworkAccessPolicyProperties{
		// 				ProvisioningState: to.Ptr("Succeeded"),
		// 				Requests: []*armsecurity.JitNetworkAccessRequest{
		// 					{
		// 						Justification: to.Ptr("testing a new version of the product"),
		// 						Requestor: to.Ptr("barbara@contoso.com"),
		// 						StartTimeUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2018-05-17T08:06:45.569Z"); return t}()),
		// 						VirtualMachines: []*armsecurity.JitNetworkAccessRequestVirtualMachine{
		// 							{
		// 								ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Compute/virtualMachines/vm1"),
		// 								Ports: []*armsecurity.JitNetworkAccessRequestPort{
		// 									{
		// 										AllowedSourceAddressPrefix: to.Ptr("192.127.0.2"),
		// 										EndTimeUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2018-05-17T09:06:45.569Z"); return t}()),
		// 										Number: to.Ptr[int32](3389),
		// 										Status: to.Ptr(armsecurity.StatusInitiated),
		// 										StatusReason: to.Ptr(armsecurity.StatusReasonUserRequested),
		// 								}},
		// 						}},
		// 				}},
		// 				VirtualMachines: []*armsecurity.JitNetworkAccessPolicyVirtualMachine{
		// 					{
		// 						ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Compute/virtualMachines/vm1"),
		// 						Ports: []*armsecurity.JitNetworkAccessPortRule{
		// 							{
		// 								AllowedSourceAddressPrefix: to.Ptr("*"),
		// 								MaxRequestAccessDuration: to.Ptr("PT3H"),
		// 								Number: to.Ptr[int32](22),
		// 								Protocol: to.Ptr(armsecurity.ProtocolAll),
		// 							},
		// 							{
		// 								AllowedSourceAddressPrefix: to.Ptr("*"),
		// 								MaxRequestAccessDuration: to.Ptr("PT3H"),
		// 								Number: to.Ptr[int32](3389),
		// 								Protocol: to.Ptr(armsecurity.ProtocolAll),
		// 						}},
		// 				}},
		// 			},
		// 	}},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Policies for protecting resources using Just-in-Time access control for the subscription, location
 *
 * @summary Policies for protecting resources using Just-in-Time access control for the subscription, location
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesResourceGroupLocation_example.json
 */
async function getJitNetworkAccessPoliciesOnAResourceGroupFromASecurityDataLocation() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const resourceGroupName = process.env["SECURITY_RESOURCE_GROUP"] || "myRg1";
  const ascLocation = "westeurope";
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (let item of client.jitNetworkAccessPolicies.listByResourceGroupAndRegion(
    resourceGroupName,
    ascLocation,
  )) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

dotnet

using System;
using System.Threading.Tasks;
using System.Xml;
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter;
using Azure.ResourceManager.SecurityCenter.Models;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesResourceGroupLocation_example.json
// this example is just showing the usage of "JitNetworkAccessPolicies_ListByResourceGroupAndRegion" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this ResourceGroupResource created on azure
// for more information of creating ResourceGroupResource, please refer to the document of ResourceGroupResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
string resourceGroupName = "myRg1";
ResourceIdentifier resourceGroupResourceId = ResourceGroupResource.CreateResourceIdentifier(subscriptionId, resourceGroupName);
ResourceGroupResource resourceGroupResource = client.GetResourceGroupResource(resourceGroupResourceId);

// get the collection of this JitNetworkAccessPolicyResource
AzureLocation ascLocation = new AzureLocation("westeurope");
JitNetworkAccessPolicyCollection collection = resourceGroupResource.GetJitNetworkAccessPolicies(ascLocation);

// invoke the operation and iterate over the result
await foreach (JitNetworkAccessPolicyResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    JitNetworkAccessPolicyData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample Response

Status code:

200

{
  "value": [
    {
      "kind": "Basic",
      "properties": {
        "virtualMachines": [
          {
            "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Compute/virtualMachines/vm1",
            "ports": [
              {
                "number": 22,
                "protocol": "*",
                "allowedSourceAddressPrefix": "*",
                "maxRequestAccessDuration": "PT3H"
              },
              {
                "number": 3389,
                "protocol": "*",
                "allowedSourceAddressPrefix": "*",
                "maxRequestAccessDuration": "PT3H"
              }
            ]
          }
        ],
        "requests": [
          {
            "virtualMachines": [
              {
                "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Compute/virtualMachines/vm1",
                "ports": [
                  {
                    "number": 3389,
                    "allowedSourceAddressPrefix": "192.127.0.2",
                    "endTimeUtc": "2018-05-17T09:06:45.5691611Z",
                    "status": "Initiated",
                    "statusReason": "UserRequested"
                  }
                ]
              }
            ],
            "startTimeUtc": "2018-05-17T08:06:45.5691611Z",
            "requestor": "barbara@contoso.com",
            "justification": "testing a new version of the product"
          }
        ],
        "provisioningState": "Succeeded"
      },
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Security/locations/westeurope/jitNetworkAccessPolicies/default",
      "name": "default",
      "type": "Microsoft.Security/locations/jitNetworkAccessPolicies",
      "location": "westeurope"
    }
  ]
}

定义

名称	说明
CloudError	对所有 Azure 资源管理器 API 的常见错误响应，可返回失败操作的错误详细信息。 (这也遵循 OData 错误响应格式.) 。
CloudErrorBody	错误详细信息。
ErrorAdditionalInfo	资源管理错误附加信息。
JitNetworkAccessPoliciesList
JitNetworkAccessPolicy
JitNetworkAccessPolicyVirtualMachine
JitNetworkAccessPortRule
JitNetworkAccessRequest
JitNetworkAccessRequestPort
JitNetworkAccessRequestVirtualMachine
protocol
status	端口的状态
statusReason	说明 为何 status 具有其值

CloudError

对所有 Azure 资源管理器 API 的常见错误响应，可返回失败操作的错误详细信息。 (这也遵循 OData 错误响应格式.) 。

名称	类型	说明
error.additionalInfo	ErrorAdditionalInfo[]	错误附加信息。
error.code	string	错误代码。
error.details	CloudErrorBody[]	错误详细信息。
error.message	string	错误消息。
error.target	string	错误目标。

CloudErrorBody

错误详细信息。

名称	类型	说明
additionalInfo	ErrorAdditionalInfo[]	错误附加信息。
code	string	错误代码。
details	CloudErrorBody[]	错误详细信息。
message	string	错误消息。
target	string	错误目标。

ErrorAdditionalInfo

资源管理错误附加信息。

名称	类型	说明
info	object	其他信息。
type	string	其他信息类型。

JitNetworkAccessPoliciesList

名称	类型	说明
nextLink	string	用于提取下一页的 URI。
value	JitNetworkAccessPolicy[]

JitNetworkAccessPolicy

名称	类型	说明
id	string	资源 ID
kind	string	资源的种类
location	string	存储资源的位置
name	string	资源名称
properties.provisioningState	string	获取实时策略的预配状态。
properties.requests	JitNetworkAccessRequest[]
properties.virtualMachines	JitNetworkAccessPolicyVirtualMachine[]	Microsoft.Compute/virtualMachines 资源类型的配置。
type	string	资源类型

JitNetworkAccessPolicyVirtualMachine

名称	类型	说明
id	string	链接到此策略的虚拟机的资源 ID
ports	JitNetworkAccessPortRule[]	虚拟机的端口配置
publicIpAddress	string	链接到此策略的Azure 防火墙的公共 IP 地址（如果适用）

JitNetworkAccessPortRule

名称	类型	说明
allowedSourceAddressPrefix	string	与“allowedSourceAddressPrefixes”参数互斥。 应为 IP 地址或 CIDR，例如“192.168.0.3”或“192.168.0.0/16”。
allowedSourceAddressPrefixes	string[]	与“allowedSourceAddressPrefix”参数互斥。
maxRequestAccessDuration	string	可以为其发出最长持续时间请求。 采用 ISO 8601 持续时间格式。 最短 5 分钟，最长 1 天
number	integer
protocol	protocol

JitNetworkAccessRequest

名称	类型	说明
justification	string	发出启动请求的理由
requestor	string	发出请求的人员的身份
startTimeUtc	string	请求的开始时间（UTC）
virtualMachines	JitNetworkAccessRequestVirtualMachine[]

JitNetworkAccessRequestPort

名称	类型	说明
allowedSourceAddressPrefix	string	与“allowedSourceAddressPrefixes”参数互斥。 应为 IP 地址或 CIDR，例如“192.168.0.3”或“192.168.0.0/16”。
allowedSourceAddressPrefixes	string[]	与“allowedSourceAddressPrefix”参数互斥。
endTimeUtc	string	请求结束的日期 & UTC
mappedPort	integer	映射到Azure 防火墙中此端口的 number 端口（如果适用）
number	integer
status	status	端口的状态
statusReason	statusReason	说明 为何 status 具有其值

JitNetworkAccessRequestVirtualMachine

名称	类型	说明
id	string	链接到此策略的虚拟机的资源 ID
ports	JitNetworkAccessRequestPort[]	为虚拟机打开的端口

protocol

名称	类型	说明
*	string
TCP	string
UDP	string

status

端口的状态

名称	类型	说明
Initiated	string
Revoked	string

statusReason

说明 为何 status 具有其值

名称	类型	说明
Expired	string
NewerRequestInitiated	string
UserRequested	string