使用 Azure CLI 建立或更新 Azure 自訂角色

發行項
12/01/2023

如果 Azure 內建角色不符合組織的特定需求，您可以建立自己的自訂角色。本文說明如何使用 Azure CLI 列出、建立、更新或刪除自訂角色。

如需如何建立自訂角色的逐步教學課程，請參閱教學課程：使用 Azure CLI 建立 Azure 自訂角色。

必要條件

若要建立自訂角色，您需要：

建立自訂角色的許可權，例如使用者存取管理員istrator
Azure Cloud Shell 或 Azure CLI

列出自訂角色

若要列出可用於指派的自訂角色，請使用 az role definition list 。下列範例會列出目前訂用帳戶中的所有自訂角色。

az role definition list --custom-role-only true --output json --query '[].{roleName:roleName, roleType:roleType}'

[
  {
    "roleName": "My Management Contributor",
    "type": "CustomRole"
  },
  {
    "roleName": "My Service Reader Role",
    "type": "CustomRole"
  },
  {
    "roleName": "Virtual Machine Operator",
    "type": "CustomRole"
  }
]

列出自訂角色定義

若要列出自訂角色定義，請使用 az role definition list 。此命令與您用於內建角色的命令相同。

az role definition list --name {roleName}

下列範例會列出 虛擬機器操作員 角色定義：

az role definition list --name "Virtual Machine Operator"

[
  {
    "assignableScopes": [
      "/subscriptions/{subscriptionId}"
    ],
    "description": "Can monitor and restart virtual machines.",
    "id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/00000000-0000-0000-0000-000000000000",
    "name": "00000000-0000-0000-0000-000000000000",
    "permissions": [
      {
        "actions": [
          "Microsoft.Storage/*/read",
          "Microsoft.Network/*/read",
          "Microsoft.Compute/*/read",
          "Microsoft.Compute/virtualMachines/start/action",
          "Microsoft.Compute/virtualMachines/restart/action",
          "Microsoft.Authorization/*/read",
          "Microsoft.ResourceHealth/availabilityStatuses/read",
          "Microsoft.Resources/subscriptions/resourceGroups/read",
          "Microsoft.Insights/alertRules/*",
          "Microsoft.Insights/diagnosticSettings/*",
          "Microsoft.Support/*"
        ],
        "dataActions": [],
        "notActions": [],
        "notDataActions": []
      }
    ],
    "roleName": "Virtual Machine Operator",
    "roleType": "CustomRole",
    "type": "Microsoft.Authorization/roleDefinitions"
  }
]

下列範例只會列出虛擬機器操作員 角色的 動作：

az role definition list --name "Virtual Machine Operator" --output json --query '[].permissions[0].actions'

[
  [
    "Microsoft.Storage/*/read",
    "Microsoft.Network/*/read",
    "Microsoft.Compute/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Authorization/*/read",
    "Microsoft.ResourceHealth/availabilityStatuses/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Insights/diagnosticSettings/*",
    "Microsoft.Support/*"
  ]
]

建立自訂角色

若要建立自訂角色，請使用 az role definition create 。角色定義可以是 JSON 描述或包含 JSON 描述的檔案路徑。

az role definition create --role-definition {roleDefinition}

下列範例會建立名為 Virtual Machine Operator 的自訂角色。此自訂角色會指派 Microsoft.Compute 、 Microsoft.儲存體 和 Microsoft.Network 資源提供者之所有讀取動作的 存取權，並指派啟動、重新開機及監視虛擬機器的存取權。此自訂角色可用於兩個訂用帳戶。此範例會使用 JSON 檔案作為輸入。

vmoperator.json

{
  "Name": "Virtual Machine Operator",
  "IsCustom": true,
  "Description": "Can monitor and restart virtual machines.",
  "Actions": [
    "Microsoft.Storage/*/read",
    "Microsoft.Network/*/read",
    "Microsoft.Compute/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Authorization/*/read",
    "Microsoft.ResourceHealth/availabilityStatuses/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Support/*"
  ],
  "NotActions": [

  ],
  "AssignableScopes": [
    "/subscriptions/{subscriptionId1}",
    "/subscriptions/{subscriptionId2}"
  ]
}

az role definition create --role-definition ~/roles/vmoperator.json

更新自訂角色

若要更新自訂角色，請先使用 az role definition list 來擷取角色定義。其次，對角色定義進行所需的變更。最後，使用 az role definition update 來儲存更新的角色定義。

az role definition update --role-definition {roleDefinition}

下列範例會將 Microsoft.Insights/diagnostic設定/ 動作新增至， Actions 並將管理群組新增至 AssignableScopes 虛擬機器操作員 自訂角色。

vmoperator.json

{
  "Name": "Virtual Machine Operator",
  "IsCustom": true,
  "Description": "Can monitor and restart virtual machines.",
  "Actions": [
    "Microsoft.Storage/*/read",
    "Microsoft.Network/*/read",
    "Microsoft.Compute/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Authorization/*/read",
    "Microsoft.ResourceHealth/availabilityStatuses/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Insights/diagnosticSettings/*",
    "Microsoft.Support/*"
  ],
  "NotActions": [

  ],
  "AssignableScopes": [
    "/subscriptions/{subscriptionId1}",
    "/subscriptions/{subscriptionId2}",
    "/providers/Microsoft.Management/managementGroups/marketing-group"
  ]
}

az role definition update --role-definition ~/roles/vmoperator.json

刪除自訂角色

移除任何使用自訂角色的角色指派。如需詳細資訊，請參閱尋找刪除自訂角色的角色指派。
使用 az role definition delete 刪除自訂角色。若要指定要刪除的角色，請使用角色名稱或角色識別碼。若要判斷角色識別碼，請使用 az role definition list 。
```
az role definition delete --name {roleNameOrId}
```
下列範例會 刪除虛擬機器操作員 自訂角色。
```
az role definition delete --name "Virtual Machine Operator"
```

共用方式為