备份和还原 Azure SQL 托管实例需要哪些 Azure RBAC 权限？答案

【问题标题】：What Azure RBAC permissions are required to backup and restore an Azure SQL Managed Instance?备份和还原 Azure SQL 托管实例需要哪些 Azure RBAC 权限？
【发布时间】：2020-12-26 02:14:24
【问题描述】：

作为基线，我的角色目前看起来像这样。对于这些任务，是否有任何权限过载或不必要？

{
  "Name": "Azure SQL Managed Instance Restore and Backup",
  "IsCustom": true,
  "Description": "Permissions requisite to permit backup and restore actions on an Azure SQL Managed Instance",
  "Actions": [
        "Microsoft.Sql/locations/*/read",
        "Microsoft.Sql/locations/instanceFailoverGroups/*",
        "Microsoft.Sql/managedInstances/*",
        "Microsoft.Network/virtualNetworks/subnets/*",
        "Microsoft.Network/virtualNetworks/*",
        "Microsoft.Network/networkSecurityGroups/*",
        "Microsoft.Network/routeTables/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*/read",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Support/*"
  ],
  "NotActions": [
  ],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>"
  ]
}

【问题讨论】：

如果我的回复有帮助，请采纳，谢谢。

标签： azure azure-active-directory azure-rbac

【解决方案1】：

就具体操作backup and restore an Azure SQL Managed Instance而言，Microsoft.Sql/managedInstances/*这个动作就够了。

但根据我的经验，有时可能会混合使用这些操作，例如当您导航到门户中的 SQL 托管实例时，单击资源组 -> 选择资源组 -> 选择 SQL 托管实例，实际上您使用了 Microsoft.Resources/subscriptions/resourceGroups/read 和 Microsoft.Sql/managedInstances/* 操作。

所以在你的情况下，我建议你使用下面的角色。

{
  "Name": "Azure SQL Managed Instance Restore and Backup",
  "IsCustom": true,
  "Description": "Permissions requisite to permit backup and restore actions on an Azure SQL Managed Instance",
  "Actions": [
        "Microsoft.Sql/locations/*/read",
        "Microsoft.Sql/locations/instanceFailoverGroups/*",
        "Microsoft.Sql/managedInstances/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [
  ],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>"
  ]
}

【讨论】：