如何使用python获取对Azure订阅具有所有者访问权限的用户列表

h6my8fg2  于 2022-11-25  发布在  Python
关注(0)|答案(3)|浏览(136)

我正在尝试获取对订阅具有所有者访问权限的用户列表。
我试着检查python azure sdk,但是没有得到任何可以完成这个功能的api。
订阅列表API可用,但它不提供对特定订阅具有访问权限的用户的详细信息。
我尝试了下面的代码

subscriptionClient = SubscriptionClient(credentials)
for subscription in subscriptionClient.subscriptions.list():
    print (subscription)

任何帮助都将不胜感激

nhaq1z21

nhaq1z211#

Azure Python开发工具包
如果您希望使用Azure Python SDK,则应使用AuthorizationManagementClient class
您可以尝试在订阅本身的范围内获取订阅的RoleAssignments。
我与C#密切合作,所以手头没有Python代码,但稍后会尝试用Python代码更新回来。

更新

下面是一个示例代码,希望您能从中获得足够的信息。

from azure.mgmt.authorization import AuthorizationManagementClient

authorizationClient = AuthorizationManagementClient(credentials, '<your subscription guid>')
roles = authorizationClient.role_assignments.list()
for role in roles:
print(role)

REST API

如果要从代码中直接调用REST API,请使用Microsoft.Authorization/roleAssignments REST API。

GET https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments?api-version=2018-01-01-preview

{scope}将为subscriptions/<your subscriptionId>,以便在订阅级别提取角色分配。
下面是对该API的请求和响应示例。
查找在订阅级别明确分配了“所有者”角色的所有用户
请求:

GET https://management.azure.com/subscriptions/{my subscription GUID}/providers/Microsoft.Authorization/roleAssignments?api-version=2018-01-01-preview

回应:
请注意,响应中的角色定义ID为“8 e3 af 657-a8 ff-443 c-a75 c-2fe 8 c4 bcb 635”。这对应于内置的所有者角色。

{"value":[{"properties":{"roleDefinitionId":"/subscriptions/{my Subscription GUID}/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635","principalId":"{some user GUID}","principalType":"User","scope":"/subscriptions/{my Subscription GUID}","createdOn":"2018-10-03T05:12:52.7213301Z","updatedOn":"2018-10-03T05:12:52.7213301Z","createdBy":"GUID","updatedBy":"GUID"},"id":"/subscriptions/{my Subscription GUID}/providers/Microsoft.Authorization/roleAssignments/83eee76b-4a0d-4f61-8c62-409501e95457","type":"Microsoft.Authorization/roleAssignments","name":"83eee76b-4a0d-4f61-8c62-409501e95457"}]}

收到响应后,它将包含角色定义ID,而不是确切的名称。对于所有内置角色,您可以通过访问此Microsoft documentation事先知道它是哪个角色。例如,所有者角色的ID为“8 e3 af 657-a8 ff-443 c-a75 c-2fe 8 c4 bcb 635”

gcmastyq

gcmastyq2#

此PowerShell命令:

(Get-AzureRmRoleAssignment -RoleDefinitionId "8e3af657-a8ff-443c-a75c-2fe8c4bcb635" -Scope "/subscriptions/<your azure sub ID>" | where {($_.ObjectType -EQ "user") -and ($_.Scope -EQ "/subscriptions/<your azure sub ID>") }  ) | select DisplayName,SignInName

将返回具有订阅所有者角色的所有Azure AD用户。
我已经尝试捕获有关此ps命令的数据包,它调用了多个rest API来完成此过程。您可以在Azure应用服务webjobs、Azure函数或Azure自动化上托管此命令,并在需要时探索webhook以获取用户列表。希望它能有所帮助。

2ic8powd

2ic8powd3#

很晚了,但这可能对其他人有帮助。下面是用python编写的代码,用于查找订阅中的所有者数量:

from azure.mgmt.authorization import AuthorizationManagementClient

authorizationClient = AuthorizationManagementClient(credentials, '<your 
subscription guid>')

def number_of_owners(client):
    results = []
    owners_list = []
    subscription_scope = '/subscriptions/<your subscription guid>'
    owner_role = '8e3af657-a8ff-443c-a75c-2fe8c4bcb635' #this is the ID for the owner role in Azure

    roles = client.role_assignments.list_for_scope(
        scope = subscription_scope,
        filter = 'atScope()'
    )        

    for role in roles:
        role_name_id = role.name
        role_assignment_details = client.role_assignments.get(
            scope = subscription_scope,
            role_assignment_name = role_name_id
        )
        role_ids = role_assignment_details.properties.role_definition_id
        if owner_role in role_ids:
            owner_role_list = role_ids.count(owner_role)
            print(owner_role_list)

相关问题