azure-rbac
以最低權限指派 Azure RBAC 角色
此技能可協助 Azure 管理員找出特定權限所需的最小 RBAC 角色，並產生安全的 CLI 命令和 Bicep 程式碼來進行指派。
تنزيل ZIP المهارة
رفع في Claude
اذهب إلى Settings → Capabilities → Skills → Upload skill
فعّل وابدأ الاستخدام
اختبرها
استخدام "azure-rbac". What role should I assign for a managed identity to read blobs?
النتيجة المتوقعة:
- Storage Blob Data Reader (preview) is the recommended built-in role for read-only access to blob storage.
- Resource scope: The role can be assigned at storage account, container, or blob level.
- For least privilege, assign at the specific container level rather than the entire storage account.
استخدام "azure-rbac". Generate Bicep code to assign a role to a service principal
النتيجة المتوقعة:
- resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { name: guid(subscription().id, servicePrincipalId, roleDefinitionId) properties: { principalId: servicePrincipalId roleDefinitionId: roleDefinitionId principalType: 'ServicePrincipal' } }
التدقيق الأمني
آمنStatic analysis flagged 4 instances of 'Weak cryptographic algorithm' at SKILL.md lines 3 and 8. These are FALSE POSITIVES. Line 3 contains YAML syntax (description: >-) for multiline strings. Line 8 references Azure MCP tools (azure__documentation, azure__extension_cli_generate). The skill is a legitimate Microsoft Azure RBAC helper that recommends least-privilege roles and generates infrastructure code.
الأنماط المكتشفة
درجة الجودة
ماذا يمكنك بناءه
授與 Blob 儲存體的讀取權限
找出服務主體讀取特定儲存體帳戶中 Blob 所需的最小角色
為 API 權限建立自訂角色
當內建角色太過廣泛時，定義具有特定 API 權限的自訂 RBAC 角色
在 CI/CD 中自動化角色指派
產生可透過 Azure DevOps 或 GitHub Actions 部署的角色指派 Bicep 程式碼
جرّب هذه الموجهات
What is the minimum RBAC role needed to read blobs in an Azure Storage account?
What RBAC role should I assign to a managed identity so it can list virtual machines in a resource group?
Generate the Azure CLI command to assign the Storage Blob Data Reader role to a user-assigned managed identity on a storage account.
Create a custom RBAC role definition that allows read and list on storage containers and blobs, but not delete or write operations.
أفضل الممارسات
- 始終在最窄的範圍指派角色（資源或資源群組 vs 訂用帳戶）
- 盡可能使用內建角色而非自訂角色，以便於維護
- 記錄每個角色指派的業務理由
تجنب
- 當有更特定的角色可用時卻指派 Owner 或 Contributor 角色
- 當資源層級範圍足以滿足需求時，卻在訂用帳戶或管理群組範圍指派角色
- 在自訂角色定義中使用萬用字元 (*) 權限