是否可以审查对ACL的更改？我应该在哪里搜索日志？
我看到有人给了“汤姆” ACL访问存储帐户。我想检查谁给了汤姆访问权限以及何时发生。
该访问可能是通过Azure门户或Azure Storage Explorer提供的。
我尝试在存储帐户中打开活动日志刀片。我已经下载了最后几天的日志。但是，该列表似乎包括RBAC更改（它标记为“创建角色分配”），而不是ACL更改。我自己知道我在最后几天进行的一些ACL变化并没有出现。
我的角色是资源组管理和资源组用户。我公司有定制角色，但我认为它们与标准角色相对应很高。
I see that somebody gave "Tom" the ACL access to a storage account. I would like to check who gave Tom the access and when it happened.
The access was probably provided via the Azure portal or Azure Storage Explorer.
I've tried opening the activity log blade in the storage account. I've downloaded the logs for the last days. However the list seems to include RBAC changes (it's labelled "Create role assignment"), but not ACL changes. Some ACL changes that I myself know I undertook in the last days don't appear there.
My role is Resource Group admin and Resource Group User. There are custom roles at my company, but I think they correspond to the standard roles to a high degree.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以通过在存储帐户上启用诊断设置来查看
设置集装箱ACL操作日志（将这些日志发送到日志分析工作空间并使用KQL您可以查询这些日志）。）。
如果您启用
默认Azure Active Directory授权在存储帐户上，您将能够在userObjectIDinrequest> requesterObjectID您可以参考此文档，对于可以在存储帐户上访问和修改ACL的RBAC角色列表，如果Azure AD Auth在存储帐户上启用了ACL帐户。
You can review the
Set Container ACLoperation logs by enabling the diagnostics settings on the storage account (sending those logs to Log analytics workspace and using kQL you can query those logs).If you enable
Default Azure Active directory authorizationon the storage account, you will be able to see theUserObjectIDinRequesterObjectIdcolumn as shown below.You can refer to this documentation, for the list of RBAC roles who can access and modify the ACL on storage account if the Azure AD Auth is enabled on the account.