通过 ARM 模板将读者角色分配给存储帐户时遇到问题答案

【问题标题】：Getting issues while assigning reader role to storage account via ARM template通过 ARM 模板将读者角色分配给存储帐户时遇到问题
【发布时间】：2019-03-03 01:41:00
【问题描述】：

我面临以下错误“创建角色分配'c**********************5'的请求无效。角色分配范围'/subscriptions/c** ********************5/resourceGroups/MyResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccountname' 必须与 URI 上指定的范围相匹配”

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "principalId": {
            "type": "string",
            "defaultValue": "My AD app ID",
            "metadata": {
                "description": "The principal to assign the role to"
            }
        },
        "builtInRoleType": {
            "type": "string",
            "defaultValue": "Reader",
            "allowedValues": [
                "Owner",
                "Contributor",
                "Reader"
            ],
            "metadata": {
                "description": "Built-in role to assign"
            }
        },
        "roleNameGuid": {
            "type": "string",
            "defaultValue": "random guid (i am getting this guid using following PS command "[System.Guid]::NewGuid().toString()")",
            "metadata": {
                "description": "A new GUID used to identify the role assignment"
            }
        }
    },
    "variables": {
        "Owner": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'this is my ownerid')]",
        "Contributor": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'this is my contributor id')]",
        "Reader": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'this is my reader id')]",
        "scope": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/MyResourceGroup/providers/Microsoft.Storage/storageAccounts/', 'this is my storage account name')]"
    },
    "resources": [
        {
            "type": "Microsoft.Authorization/roleAssignments",
            "apiVersion": "2014-10-01-preview",
            "name": "[parameters('roleNameGuid')]",
            "properties": {
                "roleDefinitionId": "[variables(parameters('builtInRoleType'))]",
                "principalId": "[parameters('principalId')]",
                "scope": "[variables('scope')]"
            }
        }
    ]
}

【问题讨论】：

标签： azure azure-storage azure-resource-manager arm-template

【解决方案1】：

这是在高于部署范围的范围内分配角色分配的常见问题。在您的情况下，部署处于资源组级别，您尝试在订阅级别（高于资源组级别）分配范围。

解决方案：您将需要使用嵌套模板部署。

要查看示例，请查看此文档链接并在此文档中搜索“Assign Role at Scope”部分：Create resources at Subscription level

【讨论】：