Azure CLI 脚本中 CDN 清除操作授权失败

Question

我正在尝试通过 giyhub 操作自动化我的工作流程，但它显示以下错误

Run azure/CLI@v1
Starting script execution via docker image mcr.microsoft.com/azure-cli:2.58.0
ERROR: (AuthorizationFailed) The client '1b577114-b48e-4f1d-aaa7-99e39635f911' with object id '1b577114-b48e-4f1d-aaa7-99e39635f911' does not have authorization to perform action 'Microsoft.Cdn/profiles/endpoints/purge/action' over scope '/subscriptions/bf94b8dd-32e1-4d61-ac66-992080104192/resourceGroups/cloudresume/providers/Microsoft.Cdn/profiles/azureresumenkg/endpoints/azureresumenkg' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed
Message: The client '1b577114-b48e-4f1d-aaa7-99e39635f911' with object id '1b577114-b48e-4f1d-aaa7-99e39635f911' does not have authorization to perform action 'Microsoft.Cdn/profiles/endpoints/purge/action' over scope '/subscriptions/bf94b8dd-32e1-4d61-ac66-992080104192/resourceGroups/cloudresume/providers/Microsoft.Cdn/profiles/azureresumenkg/endpoints/azureresumenkg' or the scope is invalid. If access was recently granted, please refresh your credentials.
Error: Error: az cli script failed.
cleaning up container...
MICROSOFT_AZURE_CLI_1711863820587_CONTAINER

Error: az cli script failed.

其目的是自动清除azure端点的内容。

Answer 1

消息：对象 ID 为“1b577114-b48e-4f1d-aaa7-99e39635f911”的客户端“1b577114-b48e-4f1d-aaa7-99e39635f911”无权执行操作“Microsoft.Cdn/profiles/endpoints/purge/action”超出范围“/subscriptions/bf94b8dd-32e1-4d61-ac66992080104192/resourceGroups/cloudresume/providers/Microsoft.Cdn/profiles/azureesumenkg/endpoints/azureresumenkg”或范围无效。如果最近授予了访问权限，请刷新您的凭据。

如果您的服务主体没有执行操作所需的

roles

或

permissions

，则会出现上述错误。

要解决该错误，请确保将

CDN Endpoint Contributor

角色分配给所需范围内的服务主体，因为它具有此权限

Microsoft.Cdn/profiles/endpoints/purge/action

。

首先，我将角色分配给门户中的服务主体。

传送门：

在这里，我使用示例 API 来清除 Azure CDN 缓存。分配角色后，我通过再次生成访问令牌来运行下面的 API 调用，并获得如下成功响应：

请求

POST https://management.azure.com/subscriptions/subid/resourceGroups/RG/providers/Microsoft.Cdn/profiles/venkatuser/endpoints/venkat123/purge?api-version=2023-05-01
Authorization: Bearer <token>

{
  "contentPaths": [
    "/folder1"
  ]
}

输出：

参考： 端点 - 清除内容 - REST API (Azure CDN) |微软学习