问题描述

在使用APIM服务中，需要为专门的一组用户赋予特殊的权限：审批APIM用户的对产品的订阅。需要自定义一个RBAC角色，那么如何来设置最少的Action满足需求呢？

问题解答

要对APIM订阅进行审批，至少需要 Microsoft.ApiManagement/service/subscriptions/write （对subscriptions的write权限）。同时，也需要有APIM资源，当前资源组，Subscriptions的Read权限。所以总起来就是需要以下Actions：

1. Microsoft.ApiManagement/service/subscriptions/write
2. Microsoft.ApiManagement/service/subscriptions/read
3. Microsoft.Resources/subscriptions/resourceGroups/read
4. Microsoft.ApiManagement/service/read

当需要在Azure门户上创建自定义RBAC 角色时候，自定义JSON内容为：

{
"properties": {
"roleName": "APIM Only Approval Subscription User",
"description": "APIM Only Approval Subscription User",
"assignableScopes": [
"/subscriptions/<your azure subscription ID>"
],
"permissions": [
{
"actions": [
"Microsoft.ApiManagement/service/subscriptions/write",
"Microsoft.ApiManagement/service/subscriptions/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.ApiManagement/service/read"
],
"notActions": [],
"dataActions": [],
"notDataActions": []
}
]
}
}

创建成功后，效果如下：

参考资料

使用 Azure 门户创建 Azure 自定义角色 ： https://docs.microsoft.com/zh-cn/azure/role-based-access-control/custom-roles-portal