本文介绍了Azure ARM 角色分配不同的资源组的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!
问题描述
我正在尝试创建一个具有虚拟机的 ARM 模板,我希望虚拟机将 AcrPull
角色分配给位于不同资源组中的容器注册表.我将范围属性设置为 ACR 的 ID(我从 https://resources.azure.com).
I'm trying to create an ARM template that has a VM, I want the VM to have AcrPull
role assignment to a Container Registry that is in a different resource group. I'm setting the scope property to the ID of the ACR (i got this from https://resources.azure.com).
{
"apiVersion": "2017-09-01",
"type": "Microsoft.Authorization/roleAssignments",
"name": "[guid(resourceGroup().id, 'stuff')]",
"properties": {
"roleDefinitionId": "[variables(parameters('builtInRoleType'))]",
"principalId": "[reference(variables('vmResourceId'), '2017-12-01', 'Full').identity.principalId]",
"scope": "[concat(/subscriptions/abc123-x123-4bef-84ec-1716390f231b/resourceGroups/someresroucegroupname/providers/Microsoft.ContainerRegistry/registries/someacrname"
},
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
]
}
我不断收到错误消息:
"The request to create role assignment '694829aa-cee5-4fe3-bf94-3ae372c14f26' is not valid. Role
assignment scope '/subscriptions/abc123-x123-4bef-84ec-1716390f231b' must match the scope specified on
the URI '/subscriptions/abc123-x123-4bef-84ec-1716390f231b/resourcegroups/myresourcegroupname'.
这甚至可能吗?
推荐答案
你需要用嵌套的模板调用来包装它,如下所示:
you need to wrap this with a nested template call like so:
{
"type": "Microsoft.Resources/deployments",
"name": "nested-role-assignment",
"apiVersion": "2017-05-10",
"resourceGroup": "your_resource_group",
"subscriptionId": "your_subscription_id",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"apiVersion": "2017-09-01",
"type": "Microsoft.Authorization/roleAssignments",
"name": "[guid(resourceGroup().id, 'stuff')]",
"properties": {
"roleDefinitionId": "[variables(parameters('builtInRoleType'))]",
"principalId": "[reference(variables('vmResourceId'), '2017-12-01', 'Full').identity.principalId]",
"scope": "[concat(/subscriptions/abc123-x123-4bef-84ec-1716390f231b/resourceGroups/someresroucegroupname/providers/Microsoft.ContainerRegistry/registries/someacrname"
}
}
]
}
}
}
因此,有效地将其直接部署到 ACR 所在的资源组.
so, effectively, deploy this directly to the resource group where ACR resides.
ps.我的名字\类型组合:
ps. my name\type combination:
"type": "Microsoft.ContainerRegistry/registries/providers/roleAssignments",
"name": "[concat('ACR_NAME_GOES_HERE/Microsoft.Authorization/', guid(resourceGroup().id, 'acr'))]",
这篇关于Azure ARM 角色分配不同的资源组的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持!