如何在 Azure Spring Apps 中使用許可權

發行項
10/01/2024

注意

基本、標準和企業方案將從 2025 年 3 月中旬開始淘汰，並停用 3 年。建議您轉換至 Azure Container Apps。如需詳細資訊，請參閱 Azure Spring Apps 淘汰公告。

標準 耗用量和專用 方案將從 2024 年 9 月 30 日起淘汰，並在六個月後完成關閉。建議您轉換至 Azure Container Apps。如需詳細資訊，請參閱將 Azure Spring Apps 標準取用和專用方案遷移至 Azure Container Apps。

本文適用於： ✔️ 基本/標準 ✔️ 企業

本文說明如何建立自定義角色，將許可權委派給 Azure Spring Apps 資源。自定義角色會擴充具有各種庫存許可權的 Azure 內建角色。

我們將實作下列自定義角色。

開發人員角色：
- 部署
- Test
- 重新啟動應用程式
- 在 Git 存放庫中套用和變更應用程式組態
- 取得記錄數據流
DevOps 工程師角色：
- 在 Azure Spring Apps 中建立、讀取、更新和刪除所有專案
Ops - 網站可靠性工程角色：
- 重新啟動應用程式
- 取得記錄數據流
- 無法變更應用程式或設定
Azure Pipelines / Jenkins / GitHub Actions 角色：
- 執行建立、讀取、更新和刪除作業
- 使用 Terraform 或 ARM 範本在服務實例內的 Azure Spring Apps 和應用程式中建立和設定所有專案：Azure Pipelines、Jenkins 和 GitHub Actions

定義開發人員角色

開發人員角色包含重新啟動應用程式的許可權，並查看其記錄數據流。此角色無法變更應用程式或組態。

入口網站
JSON

在 Azure 入口網站中，開啟您要指派自定義角色的訂用帳戶。
開啟 訪問控制（IAM）。
選取 [新增]。
選取 [ 新增自定義角色]。
選取 [下一步]：
選取 [ 新增許可權]：
在搜尋方塊中，搜尋 Microsoft.app。選取 [Microsoft Azure Spring Apps：
選取開發人員角色的許可權。

在 [Microsoft.AppPlatform/Spring] 下，選取：
- 寫入：建立或更新 Azure Spring Apps 服務實例
- 讀取：取得 Azure Spring Apps 服務實例
- 其他：列出 Azure Spring Apps 服務實例測試密鑰
（僅適用於企業方案）在 Microsoft.AppPlatform/Spring/buildServices 下，選取：
- 讀取：讀取 azure Spring Apps 組建服務Microsoft
- 其他：在 Azure Spring Apps 中取得上傳 URL
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builds 下，選取：
- 讀取：讀取 Azure Spring Apps 組建Microsoft
- 寫入：撰寫 azure Spring Apps 組建Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builds/results 底下，選取：
- 讀取：讀取 azure Spring Apps 建置結果Microsoft
- 其他：在 Azure Spring Apps 中取得記錄檔 URL
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builders 下，選取：
- 讀取：讀取 Azure Spring Apps Builders Microsoft
- 寫入：撰寫Microsoft Azure Spring Apps Builders
- 刪除：刪除 Azure Spring Apps Builders Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps Builder BuildpackBinding
- 寫入：撰寫Microsoft Azure Spring Apps Builder BuildpackBinding
- 刪除：刪除 Azure Spring Apps Builder BuildpackBinding Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/supportedBuildpacks 下，選取：
- 讀取：讀取 azure Spring Apps 支援的組建套件Microsoft
（僅適用於企業方案）在 Microsoft.AppPlatform/Spring/buildServices/supportedStacks 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps 支援的堆棧
在 [Microsoft.AppPlatform/Spring/apps] 下，選取：
- 讀取：讀取 Azure Spring Apps 應用程式Microsoft
- 其他：取得 Azure Spring Apps 應用程式資源上傳 URL Microsoft
在 [Microsoft.AppPlatform/Spring/apps/bindings 下，選取：
- 讀取：讀取 azure Spring Apps 應用程式系結Microsoft
在 [Microsoft.AppPlatform/Spring/apps/deployments 下，選取：
- 寫入：撰寫 Azure Spring Apps 應用程式部署Microsoft
- 讀取：讀取 azure Spring Apps 應用程式部署Microsoft
- 其他：開始Microsoft Azure Spring Apps 應用程式部署
- 其他：停止Microsoft Azure Spring Apps 應用程式部署
- 其他：重新啟動Microsoft Azure Spring Apps 應用程式部署
- 其他：取得 Azure Spring Apps 應用程式部署記錄檔 URL Microsoft
在 [Microsoft.AppPlatform/Spring/apps/domains 下，選取：
- 讀取：讀取 azure Spring Apps 應用程式自定義網域Microsoft
在 [Microsoft.AppPlatform/Spring/certificates] 下，選取：
- 讀取：讀取 azure Spring Apps 憑證Microsoft
在 [Microsoft.AppPlatform/locations/operationResults/Spring 底下，選取：
- 讀取：讀取作業結果
在 [Microsoft.AppPlatform/locations/operationStatus/operationId 底下，選取：
- 讀取：讀取作業狀態
選取 [新增]。
檢閱許可權。
選取 [檢閱和建立]。

在 Azure 入口網站中，開啟您要指派自定義角色的訂用帳戶。
開啟 訪問控制（IAM）。
選取 [新增]。
選取 [ 新增自定義角色]。
選取 [下一步]。
選取 [JSON] 索引標籤。
選取[ 編輯]，然後刪除預設文字：

貼上下列 JSON 以定義開發人員角色：

基本/標準方案

{
   "properties": {
     "roleName": "Developer",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/write",
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/apps/bindings/read",
           "Microsoft.AppPlatform/Spring/apps/domains/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/write",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/certificates/read",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

Enterprise 方案

{
   "properties": {
     "roleName": "Developer",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/write",
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/buildServices/read",
           "Microsoft.AppPlatform/Spring/buildServices/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/buildServices/builds/read",
           "Microsoft.AppPlatform/Spring/buildServices/builds/write",
           "Microsoft.AppPlatform/Spring/buildServices/builds/results/read",
           "Microsoft.AppPlatform/Spring/buildServices/builds/results/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/buildServices/builders/read",
           "Microsoft.AppPlatform/Spring/buildServices/builders/write",
           "Microsoft.AppPlatform/Spring/buildServices/builders/delete",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/read",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/write",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/delete",
           "Microsoft.AppPlatform/Spring/buildServices/supportedBuildpacks/read",
           "Microsoft.AppPlatform/Spring/buildServices/supportedStacks/read",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/apps/bindings/read",
           "Microsoft.AppPlatform/Spring/apps/domains/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/write",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/certificates/read",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

選取儲存。
檢閱許可權。
選取 [檢閱和建立]。

定義DevOps工程師角色

此程式會定義具有部署、測試及重新啟動 Azure Spring Apps 應用程式許可權的角色。

入口網站
JSON

在新增開發人員角色的程式中重複步驟 1 到 4。
選取 DevOps 工程師角色的權限：

在 [Microsoft.AppPlatform/Spring] 下，選取：
- 寫入：建立或更新 Azure Spring Apps 服務實例
- 刪除：刪除 Azure Spring Apps 服務實例
- 讀取：取得 Azure Spring Apps 服務實例
- 其他：啟用 Azure Spring Apps 服務實例測試端點
- 其他：停用 Azure Spring Apps 服務實例測試端點
- 其他：列出 Azure Spring Apps 服務實例測試密鑰
- 其他：重新產生 Azure Spring Apps 服務實例測試密鑰
（僅適用於企業方案）在 Microsoft.AppPlatform/Spring/buildServices 下，選取：
- 讀取：讀取 azure Spring Apps 組建服務Microsoft
- 其他：在 Azure Spring Apps 中取得上傳 URL
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/agentPools 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps 代理程式集區
- 寫入：寫入Microsoft Azure Spring Apps 代理程式集區
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builds 下，選取：
- 讀取：讀取 Azure Spring Apps 組建Microsoft
- 寫入：撰寫 azure Spring Apps 組建Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builds/results 底下，選取：
- 讀取：讀取 azure Spring Apps 建置結果Microsoft
- 其他：在 Azure Spring Apps 中取得記錄檔 URL
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builders 下，選取：
- 讀取：讀取 Azure Spring Apps Builders Microsoft
- 寫入：撰寫Microsoft Azure Spring Apps Builders
- 刪除：刪除 Azure Spring Apps Builders Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps Builder BuildpackBinding
- 寫入：撰寫Microsoft Azure Spring Apps Builder BuildpackBinding
- 刪除：刪除 Azure Spring Apps Builder BuildpackBinding Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/supportedBuildpacks 下，選取：
- 讀取：讀取 azure Spring Apps 支援的組建套件Microsoft
（僅適用於企業方案）在 Microsoft.AppPlatform/Spring/buildServices/supportedStacks 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps 支援的堆棧
在 [Microsoft.AppPlatform/Spring/apps] 下，選取：
- 寫入：寫入 Azure Spring Apps 應用程式Microsoft
- 刪除：刪除 Azure Spring Apps 應用程式Microsoft
- 讀取：讀取 Azure Spring Apps 應用程式Microsoft
- 其他：取得 Azure Spring Apps 應用程式資源上傳 URL Microsoft
- 其他：驗證 Azure Spring Apps 應用程式自定義網域Microsoft
在 [Microsoft.AppPlatform/Spring/apps/bindings 下，選取：
- 寫入：撰寫Microsoft Azure Spring Apps 應用程式系結
- 刪除：刪除 Azure Spring Apps 應用程式系結Microsoft
- 讀取：讀取 azure Spring Apps 應用程式系結Microsoft
在 [Microsoft.AppPlatform/Spring/apps/deployments 下，選取：
- 寫入：撰寫 Azure Spring Apps 應用程式部署Microsoft
- 刪除：刪除 Azure Spring Apps 應用程式部署
- 讀取：讀取 azure Spring Apps 應用程式部署Microsoft
- 其他：開始Microsoft Azure Spring Apps 應用程式部署
- 其他：停止Microsoft Azure Spring Apps 應用程式部署
- 其他：重新啟動Microsoft Azure Spring Apps 應用程式部署
- 其他：取得 Azure Spring Apps 應用程式部署記錄檔 URL Microsoft
在 [Microsoft.AppPlatform/Spring/apps/deployments/skus 下，選取：
- 讀取：列出可用的應用程式部署 SKU
在 [Microsoft.AppPlatform/locations] 下，選取：
- 其他：檢查名稱可用性
在 [Microsoft.AppPlatform/locations/operationResults/Spring 下選取：
- 讀取：讀取作業結果
在 [Microsoft.AppPlatform/locations/operationStatus/operationId 底下，選取：
- 讀取：讀取作業狀態
在 [Microsoft.AppPlatform/skus] 下，選取：
- 讀取：列出可用的 SKU
選取 [新增]。
檢閱許可權。
選取 [檢閱和建立]。

從新增開發人員角色的程序重複步驟 1 到 4。
選取 [下一步]。
選取 [JSON] 索引標籤。
選取[ 編輯]，然後刪除預設文字：

貼上下列 JSON 以定義 DevOps 工程師角色：

基本/標準方案

{
   "properties": {
     "roleName": "DevOps engineer",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/write",
           "Microsoft.AppPlatform/Spring/delete",
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/enableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/disableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/regenerateTestKey/action",
           "Microsoft.AppPlatform/Spring/apps/write",
           "Microsoft.AppPlatform/Spring/apps/delete",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/apps/validateDomain/action",
           "Microsoft.AppPlatform/Spring/apps/bindings/write",
           "Microsoft.AppPlatform/Spring/apps/bindings/delete",
           "Microsoft.AppPlatform/Spring/apps/bindings/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/write",
           "Microsoft.AppPlatform/Spring/apps/deployments/delete",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/skus/read",
           "Microsoft.AppPlatform/locations/checkNameAvailability/action",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read",
           "Microsoft.AppPlatform/skus/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

Enterprise 方案

{
   "properties": {
     "roleName": "DevOps engineer",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/write",
           "Microsoft.AppPlatform/Spring/delete",
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/enableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/disableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/regenerateTestKey/action",
           "Microsoft.AppPlatform/Spring/buildServices/read",
           "Microsoft.AppPlatform/Spring/buildServices/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/buildServices/agentPools/read",
           "Microsoft.AppPlatform/Spring/buildServices/agentPools/write",
           "Microsoft.AppPlatform/Spring/buildServices/builds/read",
           "Microsoft.AppPlatform/Spring/buildServices/builds/write",
           "Microsoft.AppPlatform/Spring/buildServices/builds/results/read",
           "Microsoft.AppPlatform/Spring/buildServices/builds/results/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/buildServices/builders/read",
           "Microsoft.AppPlatform/Spring/buildServices/builders/write",
           "Microsoft.AppPlatform/Spring/buildServices/builders/delete",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/read",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/write",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/delete",
           "Microsoft.AppPlatform/Spring/buildServices/supportedBuildpacks/read",
           "Microsoft.AppPlatform/Spring/buildServices/supportedStacks/read",
           "Microsoft.AppPlatform/Spring/apps/write",
           "Microsoft.AppPlatform/Spring/apps/delete",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/apps/validateDomain/action",
           "Microsoft.AppPlatform/Spring/apps/bindings/write",
           "Microsoft.AppPlatform/Spring/apps/bindings/delete",
           "Microsoft.AppPlatform/Spring/apps/bindings/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/write",
           "Microsoft.AppPlatform/Spring/apps/deployments/delete",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/skus/read",
           "Microsoft.AppPlatform/locations/checkNameAvailability/action",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read",
           "Microsoft.AppPlatform/skus/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

檢閱許可權。
選取 [檢閱和建立]。

定義 Ops - 網站可靠性工程角色

此程式會定義具有部署、測試及重新啟動 Azure Spring Apps 應用程式許可權的角色。

入口網站
JSON

從新增開發人員角色的程序重複步驟 1 到 4。
選取 Ops - 網站可靠性工程角色的許可權：

在 [Microsoft.AppPlatform/Spring] 下，選取：
- 讀取：取得 Azure Spring Apps 服務實例
- 其他：列出 Azure Spring Apps 服務實例測試密鑰
在 [Microsoft.AppPlatform/Spring/apps] 下，選取：
- 讀取：讀取 Azure Spring Apps 應用程式Microsoft
在 [Microsoft.AppPlatform/apps/deployments 下，選取：
- 讀取：讀取 azure Spring Apps 應用程式部署Microsoft
- 其他：開始Microsoft Azure Spring Apps 應用程式部署
- 其他：停止Microsoft Azure Spring Apps 應用程式部署
- 其他：重新啟動Microsoft Azure Spring Apps 應用程式部署
在 [Microsoft.AppPlatform/locations/operationResults/Spring 底下，選取：
- 讀取：讀取作業結果
在 [Microsoft.AppPlatform/locations/operationStatus/operationId 底下，選取：
- 讀取：讀取作業狀態
選取 [新增]。
檢閱許可權。
選取 [檢閱和建立]。

從新增開發人員角色的程序重複步驟 1 到 4。
選取 [下一步]。
選取 [JSON] 索引標籤。
選取[ 編輯]，然後刪除預設文字：

貼上下列 JSON 以定義 Ops - 網站可靠性工程角色：

Enterprise/Basic/Standard 方案

{
   "properties": {
     "roleName": "Ops - Site Reliability Engineering",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

檢閱許可權。
選取 [檢閱和建立]。

定義 Azure Pipelines / Jenkins / GitHub Actions 角色

此角色可以使用服務實例，在 Azure Spring Apps 和應用程式中建立和設定所有專案。此角色適用於發行或部署程序代碼。

入口網站
JSON

從新增開發人員角色的程序重複步驟 1 到 4。
開啟 [ 許可權] 選項。
選取 Azure Pipelines / Jenkins / GitHub Actions 角色的許可權：

在 [Microsoft.AppPlatform/Spring] 下，選取：
- 寫入：建立或更新 Azure Spring Apps 服務實例
- 刪除：刪除 Azure Spring Apps 服務實例
- 讀取：取得 Azure Spring Apps 服務實例
- 其他：啟用 Azure Spring Apps 服務實例測試端點
- 其他：停用 Azure Spring Apps 服務實例測試端點
- 其他：列出 Azure Spring Apps 服務實例測試密鑰
- 其他：重新產生 Azure Spring Apps 服務實例測試密鑰
（僅適用於企業方案）在 Microsoft.AppPlatform/Spring/buildServices 下，選取：
- 讀取：讀取 azure Spring Apps 組建服務Microsoft
- 其他：在 Azure Spring Apps 中取得上傳 URL
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builds 下，選取：
- 讀取：讀取 Azure Spring Apps 組建Microsoft
- 寫入：撰寫 azure Spring Apps 組建Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builds/results 底下，選取：
- 讀取：讀取 azure Spring Apps 建置結果Microsoft
- 其他：在 Azure Spring Apps 中取得記錄檔 URL
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builders 下，選取：
- 讀取：讀取 Azure Spring Apps Builders Microsoft
- 寫入：撰寫Microsoft Azure Spring Apps Builders
- 刪除：刪除 Azure Spring Apps Builders Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps Builder BuildpackBinding
- 寫入：撰寫Microsoft Azure Spring Apps Builder BuildpackBinding
- 刪除：刪除 Azure Spring Apps Builder BuildpackBinding Microsoft
（僅適用於企業方案）在 [Microsoft.AppPlatform/Spring/buildServices/supportedBuildpacks 下，選取：
- 讀取：讀取 azure Spring Apps 支援的組建套件Microsoft
（僅適用於企業方案）在 Microsoft.AppPlatform/Spring/buildServices/supportedStacks 下，選取：
- 讀取：讀取Microsoft Azure Spring Apps 支援的堆棧
在 [Microsoft.AppPlatform/Spring/apps] 下，選取：
- 寫入：寫入 Azure Spring Apps 應用程式Microsoft
- 刪除：刪除 Azure Spring Apps 應用程式Microsoft
- 讀取：讀取 Azure Spring Apps 應用程式Microsoft
- 其他：取得 Azure Spring Apps 應用程式資源上傳 URL Microsoft
- 其他：驗證 Azure Spring Apps 應用程式自定義網域Microsoft
在 [Microsoft.AppPlatform/Spring/apps/bindings 下，選取：
- 寫入：撰寫Microsoft Azure Spring Apps 應用程式系結
- 刪除：刪除 Azure Spring Apps 應用程式系結Microsoft
- 讀取：讀取 azure Spring Apps 應用程式系結Microsoft
在 [Microsoft.AppPlatform/Spring/apps/deployments 下，選取：
- 寫入：撰寫 Azure Spring Apps 應用程式部署Microsoft
- 刪除：刪除 Azure Spring Apps 應用程式部署
- 讀取：讀取 azure Spring Apps 應用程式部署Microsoft
- 其他：開始Microsoft Azure Spring Apps 應用程式部署
- 其他：停止Microsoft Azure Spring Apps 應用程式部署
- 其他：重新啟動Microsoft Azure Spring Apps 應用程式部署
- 其他：取得 Azure Spring Apps 應用程式部署記錄檔 URL Microsoft
在 [Microsoft.AppPlatform/Spring/apps/deployments/skus 下，選取：
- 讀取：列出可用的應用程式部署 SKU
在 [Microsoft.AppPlatform/locations] 下，選取：
- 其他：檢查名稱可用性
在 [Microsoft.AppPlatform/locations/operationResults/Spring 底下，選取：
- 讀取：讀取作業結果
在 [Microsoft.AppPlatform/locations/operationStatus/operationId 底下，選取：
- 讀取：讀取作業狀態
在 [Microsoft.AppPlatform/skus] 下，選取：
- 讀取：列出可用的 SKU
選取 [新增]。
檢閱許可權。
選取 [檢閱和建立]。

從新增開發人員角色的程序重複步驟 1 到 4。
選取 [下一步]。
選取 [JSON] 索引標籤。
選取[ 編輯]，然後刪除預設文字：

貼上下列 JSON 以定義 Azure Pipelines / Jenkins / GitHub Actions 角色：

基本/標準方案

{
   "properties": {
     "roleName": "Azure Pipelines/Provisioning",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/write",
           "Microsoft.AppPlatform/Spring/delete",
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/enableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/disableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/regenerateTestKey/action",
           "Microsoft.AppPlatform/Spring/apps/write",
           "Microsoft.AppPlatform/Spring/apps/delete",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/apps/validateDomain/action",
           "Microsoft.AppPlatform/Spring/apps/bindings/write",
           "Microsoft.AppPlatform/Spring/apps/bindings/delete",
           "Microsoft.AppPlatform/Spring/apps/bindings/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/write",
           "Microsoft.AppPlatform/Spring/apps/deployments/delete",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/skus/read",
           "Microsoft.AppPlatform/locations/checkNameAvailability/action",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

Enterprise 方案

{
   "properties": {
     "roleName": "Azure Pipelines/Provisioning",
     "description": "",
     "assignableScopes": [
       "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
     ],
     "permissions": [
       {
         "actions": [
           "Microsoft.AppPlatform/Spring/write",
           "Microsoft.AppPlatform/Spring/delete",
           "Microsoft.AppPlatform/Spring/read",
           "Microsoft.AppPlatform/Spring/enableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/disableTestEndpoint/action",
           "Microsoft.AppPlatform/Spring/listTestKeys/action",
           "Microsoft.AppPlatform/Spring/regenerateTestKey/action",
           "Microsoft.AppPlatform/Spring/buildServices/read",
           "Microsoft.AppPlatform/Spring/buildServices/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/buildServices/builds/read",
           "Microsoft.AppPlatform/Spring/buildServices/builds/write",
           "Microsoft.AppPlatform/Spring/buildServices/builds/results/read",
           "Microsoft.AppPlatform/Spring/buildServices/builds/results/getLogFileUrl/action",
           "Microsoft.AppPlatform/Spring/buildServices/builders/read",
           "Microsoft.AppPlatform/Spring/buildServices/builders/write",
           "Microsoft.AppPlatform/Spring/buildServices/builders/delete",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/read",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/write",
           "Microsoft.AppPlatform/Spring/buildServices/builders/buildpackBindings/delete",
           "Microsoft.AppPlatform/Spring/buildServices/supportedBuildpacks/read",
           "Microsoft.AppPlatform/Spring/buildServices/supportedStacks/read",
           "Microsoft.AppPlatform/Spring/apps/write",
           "Microsoft.AppPlatform/Spring/apps/delete",
           "Microsoft.AppPlatform/Spring/apps/read",
           "Microsoft.AppPlatform/Spring/apps/getResourceUploadUrl/action",
           "Microsoft.AppPlatform/Spring/apps/validateDomain/action",
           "Microsoft.AppPlatform/Spring/apps/bindings/write",
           "Microsoft.AppPlatform/Spring/apps/bindings/delete",
           "Microsoft.AppPlatform/Spring/apps/bindings/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/write",
           "Microsoft.AppPlatform/Spring/apps/deployments/delete",
           "Microsoft.AppPlatform/Spring/apps/deployments/read",
           "Microsoft.AppPlatform/Spring/apps/deployments/start/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/stop/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/restart/action",
           "Microsoft.AppPlatform/Spring/apps/deployments/getLogFileUrl/action",
           "Microsoft.AppPlatform/skus/read",
           "Microsoft.AppPlatform/locations/checkNameAvailability/action",
           "Microsoft.AppPlatform/locations/operationResults/Spring/read",
           "Microsoft.AppPlatform/locations/operationStatus/operationId/read"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ]
   }
}

選取 [新增]。
檢閱許可權。

下一步

使用 Azure 入口網站建立或更新 Azure 自訂角色

如需定義自定義許可權之三種方法的詳細資訊，請參閱：

共用方式為

如何在 Azure Spring Apps 中使用許可權

定義開發人員角色

定義DevOps工程師角色

定義 Ops - 網站可靠性工程角色

定義 Azure Pipelines / Jenkins / GitHub Actions 角色

下一步

意見反應

其他資源