向托管标识授予对事件网格目标的访问权限Grant managed identity the access to Event Grid destination

本部分介绍如何将自定义主题或域的标识添加到 Azure 角色。This section describes how to add the identity for your custom topic, or domain to an Azure role.

必备条件Prerequisites

按照下文说明分配系统所分配的托管标识:Assign a system-assigned managed identity by using instructions from the following articles:

支持的目标和 Azure 角色Supported destinations and Azure roles

为事件网格自定义主题或域启用标识后,Azure 会自动在 Azure Active Directory 中创建标识。After you enable identity for your event grid custom topic or domain, Azure automatically creates an identity in Azure Active Directory. 将此标识添加到适当的 Azure 角色,使自定义主题或域可以将事件转发到受支持的目标。Add this identity to appropriate Azure roles so that the custom topic or domain can forward events to supported destinations. 例如,将标识添加到 Azure 事件中心命名空间的“Azure 事件中心数据发送方”角色,使事件网格自定义主题可以将事件转发到该命名空间中的事件中心。For example, add the identity to the Azure Event Hubs Data Sender role for an Azure Event Hubs namespace so that the event grid custom topic can forward events to event hubs in that namespace.

当前,Azure 事件网格支持配置有系统分配的托管标识的自定义主题或域,允许将事件转发到以下目标。Currently, Azure event grid supports custom topics or domains configured with a system-assigned managed identity to forward events to the following destinations. 此表还为你提供标识应位于的角色,以便自定义主题可以转发事件。This table also gives you the roles that the identity should be in so that the custom topic can forward the events.

目标Destination Azure 角色Azure role
服务总线队列和主题Service Bus queues and topics Azure 服务总线数据发送方Azure Service Bus Data Sender
Azure 事件中心Azure Event Hubs Azure 事件中心数据发送方Azure Event Hubs Data Sender
Azure Blob 存储Azure Blob storage 存储 Blob 数据参与者Storage Blob Data Contributor
Azure 队列存储Azure Queue storage 存储队列数据消息发送方Storage Queue Data Message Sender

使用 Azure 门户Use the Azure portal

你可以使用 Azure 门户将自定义主题或域标识分配给相应的角色,让自定义主题或域可以将事件转发到目标。You can use the Azure portal to assign the custom topic or domain identity to an appropriate role so that the custom topic or domain can forward events to the destination.

以下示例将名为“msitesttopic”的事件网格自定义主题的托管标识添加到包含队列或主题资源的服务总线命名空间的“Azure 服务总线数据发送方”角色 。The following example adds a managed identity for an event grid custom topic named msitesttopic to the Azure Service Bus Data Sender role for a Service Bus namespace that contains a queue or topic resource. 在命名空间级别添加到角色时,事件网格自定义主题可以将事件转发到命名空间中的所有实体。When you add to the role at the namespace level, the event grid custom topic can forward events to all entities within the namespace.

  1. Azure 门户中,转到“服务总线命名空间”。Go to your Service Bus namespace in the Azure portal.
  2. 在左窗格中选择“访问控制”。Select Access Control in the left pane.
  3. 在“添加角色分配”部分中选择“添加” 。Select Add in the Add a role assignment section.
  4. 在“添加角色分配”页上执行以下步骤:On the Add a role assignment page, do the following steps:
    1. 选择角色。Select the role. 在本例中,它是“Azure 服务总线数据发送方”。In this case, it's Azure Service Bus Data Sender.
    2. 为事件网格自定义主题或域选择“标识”。Select the identity for your event grid custom topic or domain.
    3. 选择“保存”以保存配置。Select Save to save the configuration.

这些步骤与向表中提到的其他角色添加标识相似。The steps are similar for adding an identity to other roles mentioned in the table.

使用 Azure CLIUse the Azure CLI

本部分中的示例展示了如何使用 Azure CLI 向 Azure 角色添加标识。The example in this section shows you how to use the Azure CLI to add an identity to an Azure role. 示例命令适用于事件网格自定义主题。The sample commands are for event grid custom topics. 适用于事件网格域的命令也是类似的。The commands for event grid domains are similar.

获取自定义主题的系统标识的主体 IDGet the principal ID for the custom topic's system identity

首先,获取自定义主题的系统托管标识的主体 ID,并将该标识分配给相应的角色。First, get the principal ID of the custom topic's system-managed identity and assign the identity to appropriate roles.

topic_pid=$(az ad sp list --display-name "$<TOPIC NAME>" --query [].objectId -o tsv)

在不同范围内创建事件中心的角色分配Create a role assignment for event hubs at various scopes

以下 CLI 示例演示如何在命名空间级别或事件中心级别将自定义主题的标识添加到“Azure 事件中心数据发送方”角色。The following CLI example shows how to add a custom topic's identity to the Azure Event Hubs Data Sender role at the namespace level or at the event hub level. 如果在命名空间级别创建角色分配,则自定义主题可以将事件转发到该命名空间中的所有事件中心。If you create the role assignment at the namespace level, the custom topic can forward events to all event hubs in that namespace. 如果在事件中心级别创建角色分配,则自定义主题只能将事件转发到该特定事件中心。If you create a role assignment at the event hub level, the custom topic can forward events only to that specific event hub.

role="Azure Event Hubs Data Sender" 
namespaceresourceid=$(az eventhubs namespace show -n $<EVENT HUBS NAMESPACE NAME> -g <RESOURCE GROUP of EVENT HUB> --query "{I:id}" -o tsv) 
eventhubresourceid=$(az eventhubs eventhub show -n <EVENT HUB NAME> --namespace-name <EVENT HUBS NAMESPACE NAME> -g <RESOURCE GROUP of EVENT HUB> --query "{I:id}" -o tsv) 

# create role assignment for the whole namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$namespaceresourceid" 

# create role assignment scoped to just one event hub inside the namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$eventhubresourceid" 

在不同的范围内创建服务总线主题的角色分配Create a role assignment for a Service Bus topic at various scopes

以下 CLI 示例演示如何在命名空间级别或服务总线主题级别将事件网格自定义主题的标识添加到“Azure 服务总线数据发送方”角色。The following CLI example shows how to add an event grid custom topic's identity to the Azure Service Bus Data Sender role at the namespace level or at the Service Bus topic level. 如果在命名空间级别创建角色分配,则事件网格主题可以将事件转发到该命名空间中的所有实体(服务总线队列或主题)。If you create the role assignment at the namespace level, the event grid topic can forward events to all entities (Service Bus queues or topics) within that namespace. 如果在服务总线队列或主题级别创建角色分配,则事件网格自定义主题只能将事件转发到该特定的服务总线队列或主题。If you create a role assignment at the Service Bus queue or topic level, the event grid custom topic can forward events only to that specific Service Bus queue or topic.

role="Azure Service Bus Data Sender" 
namespaceresourceid=$(az servicebus namespace show -n $RG\SB -g "$RG" --query "{I:id}" -o tsv 
sbustopicresourceid=$(az servicebus topic show -n topic1 --namespace-name $RG\SB -g "$RG" --query "{I:id}" -o tsv) 

# create role assignment for the whole namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$namespaceresourceid" 

# create role assignment scoped to just one hub inside the namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$sbustopicresourceid" 

后续步骤Next steps

由于你已经将系统分配的标识分配给相应自定义主题或域,并将该标识添加到目标上的对应角色中,请参阅使用托管标识传递事件中有关使用标识传递事件到目标的对应内容。Now that you have assigned a system-assigned identity to your custom topic, or domain, and added the identity to appropriate roles on destinations, see Deliver events using the managed identity on delivering events to destinations using the identity.