Azure RBAC权限树？

Question

Is there a way to query Azure (via REST or CLI) to see which permissions are required/granted for certain actions?

For example, if I wanted to assign an SPN with Microsoft.Compute/virtualMachines/write permissions so it could create a VM, I would want to review what other permissions are granted/required before assigning it to said SPN.

Answer 1

As far as I know there is no way to list dependencies in the way you describe. The Powershell cmdlet Get-AzureRmProviderOperation gives some good information on what permissions needed. https://docs.microsoft.com/en-us/powershell/module/azurerm.resources/get-azurermprovideroperation?view=azurermps-5.0.0

Answer 2

The Actions property of a custom role specifies the Azure operations to which the role grants access. It is a collection of operation strings that identify securable operations of Azure resource providers. Operation strings follow the format of

Microsoft.<ProviderName>/<ChildResourceType>/<action>

Use Get-AzureRmProviderOperation (in PowerShell) or azure provider operations show (in Azure CLI) to list operations of Azure resource providers.

For more details, refer " Create custom roles for Azure Role-Based Access Control ".