python - 创建 Azure 事件网格主题错误

问题描述

我正在编写一个旨在创建事件网格主题的 python 脚本。

我正在关注一些 Microsoft 教程和 Github 存储库，并编写了一些 python 代码来创建主题。

Python 示例：https ://docs.microsoft.com/en-us/samples/azure-samples/event-grid-python-public-consume-events/event-grid-python-public-consume-events/

Github 存储库：https ://github.com/Azure-Samples/event-grid-python-public-consume-events

Azure 服务主体：https ://azure.microsoft.com/documentation/articles/resource-group-create-service-principal-portal

我想出了这个python代码：

def CreateOrUpdateTopics(subscriptionId, clientId, clientSecret,tenantId,resourceGroup,location, topics):   

        credentials = ServicePrincipalCredentials(
            client_id=clientId,
            secret=clientSecret,
            tenant=tenantId
            )

        print("\nCreate event grid management client")
        event_grid_client = EventGridManagementClient(credentials, subscriptionId)

        for topic in topics:
            print(f'\nCreating EventGrid topic {topic}')
            topic_result_poller = event_grid_client.topics.create_or_update(resourceGroup,
                                                                     topic,
                                                                     Topic(
                                                                         location=location,
                                                                         tags={'createdBy': 'MCCC'}
                                                                     ))
            # Blocking call            
            topic_result = topic_result_poller.result()

            ## ERROR SHOWS UP HERE
            print(topic_result)

当我执行代码时，我收到一条消息

对象 ID 为“zzzz”的客户端“zzzz”无权在“/subscriptions/zzz/resourceGroups/MCCC-RG/providers/Microsoft.EventGrid/topics/Temperature”范围内执行“Microsoft.EventGrid/topics/write”操作' 或范围无效。如果最近授予访问权限，请刷新您的凭据。

我在 Azure Active Directory 中注册了一个新应用：

我还为 SP 的资源组分配了一个角色。

似乎我在我的服务原则上缺少一些角色访问权限，尽管我似乎无法找到它应该是什么的参考。

你能指出我正确的方向吗？

标签： pythonazureazure-active-directoryazure-eventgrid

解决方案

查看的角色定义EventGrid EventSubscription Contributor，它没有执行Microsoft.EventGrid/topics/write操作的权限。只允许以下操作：

      "Microsoft.Authorization/*/read",
      "Microsoft.EventGrid/eventSubscriptions/*",
      "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
      "Microsoft.EventGrid/locations/eventSubscriptions/read",
      "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
      "Microsoft.Insights/alertRules/*",
      "Microsoft.Resources/deployments/*",
      "Microsoft.Resources/subscriptions/resourceGroups/read",
      "Microsoft.Support/*"

您需要做的是创建一个Custom Role具有Microsoft.EventGrid/topics/write作为允许操作之一的内容。

同样link，这是您可以创建和使用的自定义角色的一个定义：

{
  "Name": "Event grid contributor role",
  "Id": "4BA6FB33-2955-491B-A74F-53C9126C9514",
  "IsCustom": true,
  "Description": "Event grid contributor role",
  "Actions": [
    "Microsoft.EventGrid/*/write",
    "Microsoft.EventGrid/*/delete",
    "Microsoft.EventGrid/topics/listkeys/action",
    "Microsoft.EventGrid/topics/regenerateKey/action",
    "Microsoft.EventGrid/eventSubscriptions/getFullUrl/action"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/<Subscription id>"
  ]
}

python - 创建 Azure 事件网格主题错误 - “无权执行操作”

问题描述

解决方案

推荐阅读