您如何利用Azure政策拒绝RBAC权限？

发布于 2025-02-12 11:15:15 字数 418 浏览 0 评论 0 原文

下面的示例代码。我需要格式化Azure策略，以将写入权限操作阻止存储帐户。因为在几个角色定义上存在此许可，因此需要阻止许可行动本身。 Azure政策是否可以？

    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "Microsoft.Authorization/roleDefinitions/permissions.actions[*]",
            "equals": "Microsoft.Storage/storageaccounts/write"
          }
        ]
      },
      "then": {
        "effect": "Deny"
      }
    }
  },

原文

Sample code below. I need to format an azure policy to block write permission actions to a storage account. Because this permission exists on several role definitions, the permission action itself needs to be blocked. Is this possible with azure policy?

    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "Microsoft.Authorization/roleDefinitions/permissions.actions[*]",
            "equals": "Microsoft.Storage/storageaccounts/write"
          }
        ]
      },
      "then": {
        "effect": "Deny"
      }
    }
  },

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

红尘作伴 2025-02-19 11:15:15

是的，您可以利用Azure策略来拒绝RBAC权限。

在此使用以下Azure策略进行同样的尝试href =“ https://github.com/azure/azure-policy/blob/master/samples/authorization/Allowed-Role-definitions/azurepolicy.json” rel =“ nofollow noreferrer”> github 博客：

{
"name": "deny-role-definitions",
"properties": {
"displayName": "Denied Role Definitions",
"description": "This policy defines an denied list of role definitions",
"mode": "All",
"parameters": {
"roleDefinitionIds": {
"type": "array",
"metadata": {
"description": "The list of role definition Ids",
"displayName": "Denied Role Definitions"
}
}
},
"policyRule": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Authorization/roleAssignments"
},
"effect": "deny"
}
}
}
}

Yes, you can utilize azure policy to deny RBAC permissions.

To do the same try using the below azure policy by timwarner-msft in this GitHub blog:

{
"name": "deny-role-definitions",
"properties": {
"displayName": "Denied Role Definitions",
"description": "This policy defines an denied list of role definitions",
"mode": "All",
"parameters": {
"roleDefinitionIds": {
"type": "array",
"metadata": {
"description": "The list of role definition Ids",
"displayName": "Denied Role Definitions"
}
}
},
"policyRule": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Authorization/roleAssignments"
},
"effect": "deny"
}
}
}
}

回复收藏 0 原文

~没有更多了~