“朕赐给你，才是你的；朕不给，你不能抢”--custome role在Azure权限管理中的简单实践

在开始详细讨论技术问题之前，有一些个人观点想发表一下：

---作为一个甲方云平台的掌控着，如果任何事情你都是让partner全部帮你搞定，自己既不审核也不研究，那无论是对于公司还是个人发展来说都是没任何实际上的帮助。对公司，有你没有你反正都能做事，因为说到底你甲方的云平台治理以及合规几乎等于没有，规则也都是别人说了算，要你有何用呢？还浪费公司的用人成本。对个人来说，你不仅没有从管理云平台中学习到任何东西，等哪天遇到职位变动，你跑到市场上也没有任何的竞争力，因为现在市场上即便是管理岗位也都需要一定的技术背景，更何况是要做事的。

---学习任何技能如果你都想着让别人来教你而不是自学思考，虽然短时间内可以掌握做某一件事情的方法，但是从长期来说你依然和一个战五渣没有任何区别。因为你根本没有掌握学习最本质的东西。作为一个IT从业人员，自学能力往往决定了你在技术层面能走多远。

---再忙也要沉淀下来思考总结。如果整天都在重复的劳动，没有去思考，总结，那你的知识体系永远是零散的，你的手中永远只有information而不是knowledge。

接下来我们进入正题。

在之前的文章“如何利用Azure Automation以及Tag自动开关VM” 一文中我们有提到如果利用Azure Automation做到自动开关机来节省开发测试VM的费用，但是你能做的只有仅仅如此么？

NoNoNo......即便你做到了每天早八点到晚八点的开关机，application vendor/owner 真的每天都会去用满么？可能他们一周也就两三天的时间进行开发和测试，其余时候都是空跑着。

如果突然哪天他们要晚上八点后或者周末开机，你还要手动从portal或者Azure手机控制端帮助他们进行start操作。即便你有partner，你也至少要发一条微信或者邮件来进行授权吧？何其低效！如果你正好在国外旅游呢？岂不是打扰了你度假的美好时光？

那我们换一个思路，假如Application team可以自己开关VM,然后你著需要每天晚上十一点你设定一个强制关机job，其实某种程度上既方便了自己和别人，也进一步起到了cost saving 的效果。

其实这个操作过程非常的简单，如果你有一定的自学领悟能力可以通过以下链接进行实际操作，只要有一定的powershell基础的基本都能够搞定：

https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-powershell

那我在这里主要通过授权开机的案例来大概阐述一下整个思路。

1. 查看已有的role

也许会有人觉得现有的RBAC role难道解决不了问题么？呵呵，那我们一起看下

安装Azure Powershell和登陆azure中国环境的步骤我就不做阐述了。

首先我们先看一下目前有哪些role和VM是相关的，运行如下命令：

Get-AzureRmRoleDefinition | where name -like "*virtual machine*" | ConvertTo-Json

输出如下

[
    {
        "Name":  "Classic Virtual Machine Contributor",
        "Id":  "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
        "IsCustom":  false,
        "Description":  "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they’re connected to.",
        "Actions":  [
                        "Microsoft.Authorization/*/read",
                        "Microsoft.ClassicCompute/domainNames/*",
                        "Microsoft.ClassicCompute/virtualMachines/*",
                        "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
                        "Microsoft.ClassicNetwork/reservedIps/link/action",
                        "Microsoft.ClassicNetwork/reservedIps/read",
                        "Microsoft.ClassicNetwork/virtualNetworks/join/action",
                        "Microsoft.ClassicNetwork/virtualNetworks/read",
                        "Microsoft.ClassicStorage/storageAccounts/disks/read",
                        "Microsoft.ClassicStorage/storageAccounts/images/read",
                        "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
                        "Microsoft.ClassicStorage/storageAccounts/read",
                        "Microsoft.Insights/alertRules/*",
                        "Microsoft.ResourceHealth/availabilityStatuses/read",
                        "Microsoft.Resources/deployments/*",
                        "Microsoft.Resources/subscriptions/resourceGroups/read",
                        "Microsoft.Support/*"
                    ],
        "NotActions":  [

                       ],
        "AssignableScopes":  [
                                 "/"
                             ]
    },
    {
        "Name":  "Virtual Machine Administrator Login",
        "Id":  "1c0163c0-47e6-4577-8991-ea5c82e286e4",
        "IsCustom":  false,
        "Description":  "View Virtual Machines in the portal and login as administrator",
        "Actions":  [
                        "Microsoft.Network/publicIPAddresses/read",
                        "Microsoft.Network/virtualNetworks/read",
                        "Microsoft.Network/loadBalancers/read",
                        "Microsoft.Network/networkInterfaces/read",
                        "Microsoft.Compute/virtualMachines/*/read"
                    ],
        "NotActions":  [

                       ],
        "AssignableScopes":  [
                                 "/"
                             ]
    },
    {
        "Name":  "Virtual Machine Contributor",
        "Id":  "9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
        "IsCustom":  false,
        "Description":  "Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they�re connected to.",
        "Actions":  [
                        "Microsoft.Authorization/*/read",
                        "Microsoft.Compute/availabilitySets/*",
                        "Microsoft.Compute/locations/*",
                        "Microsoft.Compute/virtualMachines/*",
                        "Microsoft.Compute/virtualMachineScaleSets/*",
                        "Microsoft.DevTestLab/schedules/*",
                        "Microsoft.Insights/alertRules/*",
                        "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
                        "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
                        "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
                        "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
                        "Microsoft.Network/loadBalancers/read",
                        "Microsoft.Network/loadBalancers/probes/join/action",
                        "Microsoft.Network/locations/*",
                        "Microsoft.Network/networkInterfaces/*",
                        "Microsoft.Network/networkSecurityGroups/join/action",
                        "Microsoft.Network/networkSecurityGroups/read",
                        "Microsoft.Network/publicIPAddresses/join/action",
                        "Microsoft.Network/publicIPAddresses/read",
                        "Microsoft.Network/virtualNetworks/read",
                        "Microsoft.Network/virtualNetworks/subnets/join/action",
                        "Microsoft.RecoveryServices/locations/*",
                        "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
                        "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
                        "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
                        "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
                        "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
                        "Microsoft.RecoveryServices/Vaults/read",
                        "Microsoft.RecoveryServices/Vaults/usages/read",
                        "Microsoft.RecoveryServices/Vaults/write",
                        "Microsoft.ResourceHealth/availabilityStatuses/read",
                        "Microsoft.Resources/deployments/*",
                        "Microsoft.Resources/subscriptions/resourceGroups/read",
                        "Microsoft.Storage/storageAccounts/listKeys/action",
                        "Microsoft.Storage/storageAccounts/read",
                        "Microsoft.Support/*"
                    ],
        "NotActions":  [

                       ],
        "AssignableScopes":  [
                                 "/"
                             ]
    },
    {
        "Name":  "Virtual Machine User Login",
        "Id":  "fb879df8-f326-4884-b1cf-06f3ad86be52",
        "IsCustom":  false,
        "Description":  "View Virtual Machines in the portal and login as a regular user.",
        "Actions":  [
                        "Microsoft.Network/publicIPAddresses/read",
                        "Microsoft.Network/virtualNetworks/read",
                        "Microsoft.Network/loadBalancers/read",
                        "Microsoft.Network/networkInterfaces/read",
                        "Microsoft.Compute/virtualMachines/*/read"
                    ],
        "NotActions":  [

                       ],
        "AssignableScopes":  [
                                 "/"
                             ]
    }
]

最接近我们需求的是Azure Virtual Machine Contributor这个role,但是你在action中你会发现有一些多余的权限是和开关机是没有任何关系的，所以我们依然需要尽可能控制好权限的颗粒度

2.确定你需要哪些权限，并准备JSON文件。

运行以下命令来get所有VM的action:

Get-AzureRmProviderOperation "Microsoft.Compute/virtualMachines/*" | FT OperationName, Operation, Description -AutoSize

输出如下：

OperationName                                  Operation                                                      Description
-------------                                  ---------                                                      -----------
Get Virtual Machine                            Microsoft.Compute/virtualMachines/read                         Get the properties of a virtual machine
Create or Update Virtual Machine               Microsoft.Compute/virtualMachines/write                        Creates a new virtual machine or updates an existing virtual machine
Delete Virtual Machine                         Microsoft.Compute/virtualMachines/delete                       Deletes the virtual machine
Start Virtual Machine                          Microsoft.Compute/virtualMachines/start/action                 Starts the virtual machine
Power Off Virtual Machine                      Microsoft.Compute/virtualMachines/powerOff/action              Powers off the virtual machine. Note that the virtual machine will continue to be billed.
Redeploy Virtual Machine                       Microsoft.Compute/virtualMachines/redeploy/action              Redeploys virtual machine
Restart Virtual Machine                        Microsoft.Compute/virtualMachines/restart/action               Restarts the virtual machine
Deallocate Virtual Machine                     Microsoft.Compute/virtualMachines/deallocate/action            Powers off the virtual machine and releases the compute resources
Generalize Virtual Machine                     Microsoft.Compute/virtualMachines/generalize/action            Sets the virtual machine state to Generalized and prepares the virtual machine for capture
Capture Virtual Machine                        Microsoft.Compute/virtualMachines/capture/action               Captures the virtual machine by copying virtual hard disks and generates a template that can be used to create similar virtual machines
Run Command on Virtual Machine                 Microsoft.Compute/virtualMachines/runCommand/action            Executes a predefined script on the virtual machine
Convert Virtual Machine disks to Managed Disks Microsoft.Compute/virtualMachines/convertToManagedDisks/action Converts the blob based disks of the virtual machine to managed disks
Perform Maintenance Redeploy                   Microsoft.Compute/virtualMachines/performMaintenance/action    Performs Maintenance Operation on the VM.
Reimage Virtual Machine                        Microsoft.Compute/virtualMachines/reimage/action               Reimages virtual machine which is using differencing disk.
Log in to Virtual Machine                      Microsoft.Compute/virtualMachines/login/action                 Log in to a virtual machine as a regular user
Log in to Virtual Machine as administrator     Microsoft.Compute/virtualMachines/loginAsAdmin/action          Log in to a virtual machine with Windows administrator or Linux root user privileges
Get Virtual Machine Instance View              Microsoft.Compute/virtualMachines/instanceView/read            Gets the detailed runtime status of the virtual machine and its resources
Lists Available Virtual Machine Sizes          Microsoft.Compute/virtualMachines/vmSizes/read                 Lists available sizes the virtual machine can be updated to
Get Virtual Machine Extension                  Microsoft.Compute/virtualMachines/extensions/read              Get the properties of a virtual machine extension
Create or Update Virtual Machine Extension     Microsoft.Compute/virtualMachines/extensions/write             Creates a new virtual machine extension or updates an existing one
Delete Virtual Machine Extension               Microsoft.Compute/virtualMachines/extensions/delete            Deletes the virtual machine extension                                                                                                  

结合之前的Azure Virtual Machine contributor其中我们筛选了一些action,并自定义如下的json文件,

{
  "Name": "Azure VM Power Operator",
  "Id": null,
  "IsCustom": true,
  "Description": "Allows for Start/Power Off VMs",
  "Actions": [
    "Microsoft.Compute/*/read",
    "Microsoft.Storage/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/powerOff/action ",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Compute/virtualMachines/deallocate/action"
  ],
  "NotActions": [],
  "AssignableScopes": [
     "/subscriptions/11111111-1111-1111-1111-111111111111"

  ]
}

具体的action可以根据自己的需求来选择,其中assignablescope里要填写自己想要使用此role的订阅

3. 创建custom role

创建好后保存为json文件到某个路径比如C:\CustomRoles\customrole1.json， 然后运行如下脚本创建custom role

New-AzureRmRoleDefinition -InputFile "C:\CustomRoles\customrole1.json"

创建好后你可以get一下看是否生效：

 Get-AzureRmRoleDefinition -Name "Azure VM Power Operator" | ConvertTo-Json

输出如下：

{
    "Name":  "Azure VM Power Operator",
    "Id":  "67eb4d22-9063-411c-8be2-75b800b07625",
    "IsCustom":  true,
    "Description":  "Allows for Start/Power Off VMs",
    "Actions":  [
                    "Microsoft.Compute/*/read",
                    "Microsoft.Storage/*/read",
                    "Microsoft.Compute/virtualMachines/start/action",
                    "Microsoft.Compute/virtualMachines/powerOff/action",
                    "Microsoft.Compute/virtualMachines/restart/action",
                    "Microsoft.Compute/virtualMachines/deallocate/action"
                ],
    "NotActions":  [

                   ],
    "AssignableScopes":  [

                             "/subscriptions/11111111-1111-1111-1111-111111111111"
                         ]
}

你也可以通过一些powershell命令去增删改你的custome role，具体操作文章开始的连接中也都有，这里不多作详细阐述，主要以介绍思路为主

4. 授权

通过Azure portal或者powershell在相应的VM上对特定账号进行授权：

可以看到role的下拉菜单里已经有我们自定义的“Azure VM Power Operator”

总的来说azure RBAC的custom role可以满足绝大多数企业对Azure的权限管控需求，但具体的哪些role需要哪些action,依然还是要企业云平台的管理者根据自身的情况自己去定义。

如果有哪些更好的使用场景也欢迎大家留言讨论。