备份和还原 Azure SQL 托管实例需要哪些 Azure RBAC 权限？

Question

As a baseline, my role currently looks like this. Are there any permissions that are overloaded or unnecessary for these tasks?

{
  "Name": "Azure SQL Managed Instance Restore and Backup",
  "IsCustom": true,
  "Description": "Permissions requisite to permit backup and restore actions on an Azure SQL Managed Instance",
  "Actions": [
        "Microsoft.Sql/locations/*/read",
        "Microsoft.Sql/locations/instanceFailoverGroups/*",
        "Microsoft.Sql/managedInstances/*",
        "Microsoft.Network/virtualNetworks/subnets/*",
        "Microsoft.Network/virtualNetworks/*",
        "Microsoft.Network/networkSecurityGroups/*",
        "Microsoft.Network/routeTables/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*/read",
        "Microsoft.Insights/metrics/read",
        "Microsoft.Insights/metricDefinitions/read",
        "Microsoft.ResourceHealth/availabilityStatuses/read",
        "Microsoft.Support/*"
  ],
  "NotActions": [
  ],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>"
  ]
}

Answer 1

Just to the specific operations backup and restore an Azure SQL Managed Instance , the Microsoft.Sql/managedInstances/* action should be enough.

But from my experience, the actions may be used mixed sometimes, eg when you navigate to the SQL Managed Instance in the portal, you click the resource groups -> select the resouce group -> select the SQL Managed Instance, actually you used Microsoft.Resources/subscriptions/resourceGroups/read and Microsoft.Sql/managedInstances/* actions.

So in your case, I recommend you to use the role like below.

{
  "Name": "Azure SQL Managed Instance Restore and Backup",
  "IsCustom": true,
  "Description": "Permissions requisite to permit backup and restore actions on an Azure SQL Managed Instance",
  "Actions": [
        "Microsoft.Sql/locations/*/read",
        "Microsoft.Sql/locations/instanceFailoverGroups/*",
        "Microsoft.Sql/managedInstances/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [
  ],
  "AssignableScopes": [
    "/subscriptions/<subscription-id>"
  ]
}