使用托管标识进行事件传递Event delivery with a managed identity

本文介绍了如何为 Azure 事件网格主题或域启用托管服务标识This article describes how to enable a managed service identity for Azure event grid topics or domains. 使用它将事件转发到受支持的目标,如服务总线队列和主题、事件中心和存储帐户。Use it to forward events to supported destinations such as Service Bus queues and topics, event hubs, and storage accounts.

本文详细介绍了以下步骤:Here are the steps that are covered in detail in this article:

  1. 使用系统分配的标识创建主题或域,或者更新现有主题或域以启用标识。Create a topic or domain with a system-assigned identity, or update an existing topic or domain to enable identity.
  2. 在目标(例如,服务总线队列)上将标识添加到相应角色(例如,服务总线数据发送方)。Add the identity to an appropriate role (for example, Service Bus Data Sender) on the destination (for example, a Service Bus queue).
  3. 创建事件订阅时,允许使用标识将事件传送到目标。When you create event subscriptions, enable the usage of the identity to deliver events to the destination.

创建带有标识的主题或域Create a topic or domain with an identity

首先,让我们看看如何创建带有系统托管标识的主题或域。First, let's look at how to create a topic or a domain with a system-managed identity.

使用 Azure 门户Use the Azure portal

在 Azure 门户中创建主题或域时,可以为其启用系统分配的标识。You can enable system-assigned identity for a topic or domain while you create it in the Azure portal. 下图显示了如何为主题启用系统托管标识。The following image shows how to enable a system-managed identity for a topic. 基本上,你可以在主题创建向导的“高级”页面上选择“启用系统分配的标识”选项 。Basically, you select the option Enable system assigned identity on the Advanced page of the topic creation wizard. 在域创建向导的“高级”页上也可以看到此选项。You'll see this option on the Advanced page of the domain creation wizard too.

创建主题时启用标识

使用 Azure CLIUse the Azure CLI

你还可以使用 Azure CLI 创建具有系统分配标识的主题或域。You can also use the Azure CLI to create a topic or domain with a system-assigned identity. 使用 az eventgrid topic create 命令,将 --identity 参数设置为 systemassignedUse the az eventgrid topic create command with the --identity parameter set to systemassigned. 如果不为此参数指定值,则使用默认值 noidentityIf you don't specify a value for this parameter, the default value noidentity is used.

# create a topic with a system-assigned identity
az eventgrid topic create -g <RESOURCE GROUP NAME> --name <TOPIC NAME> -l <LOCATION>  --identity systemassigned

类似地,可以使用 az eventgrid domain create 命令创建具有系统托管标识的域。Similarly, you can use the az eventgrid domain create command to create a domain with a system-managed identity.

为现有主题或域启用标识Enable an identity for an existing topic or domain

上一部分介绍了如何在创建主题或域时启用系统托管标识。In the previous section, you learned how to enable a system-managed identity while you created a topic or a domain. 本部分介绍如何为现有主题或域启用系统托管标识。In this section, you learn how to enable a system-managed identity for an existing topic or domain.

使用 Azure 门户Use the Azure portal

下面的过程展示了如何为主题启用系统托管标识。The following procedure shows you how to enable system-managed identity for a topic. 为域启用标识的步骤类似。The steps for enabling an identity for a domain are similar.

  1. 转到 Azure 门户Go to the Azure portal.

  2. 在顶部的搜索栏中,搜索“事件网格主题”。Search for event grid topics in the search bar at the top.

  3. 选择要为其启用托管标识的主题。Select the topic for which you want to enable the managed identity.

  4. 切换到“标识”选项卡。Switch to the Identity tab.

  5. 打开启用标识的开关。Turn on the switch to enable the identity.

  6. 在工具栏上选择“保存”,保存该设置。Select Save on the toolbar to save the setting.

    主题的“标识”页

你可以使用类似的步骤为事件网格域启用标识。You can use similar steps to enable an identity for an event grid domain.

使用 Azure CLIUse the Azure CLI

使用将 az eventgrid topic update 命令并将 --identity 设置为 systemassigned为现有主题启用系统分配的标识。Use the az eventgrid topic update command with --identity set to systemassigned to enable system-assigned identity for an existing topic. 如果要禁用标识,请将该值指定为 noidentityIf you want to disable the identity, specify noidentity as the value.

# Update the topic to assign a system-assigned identity. 
az eventgrid topic update -g $rg --name $topicname --identity systemassigned --sku basic 

更新现有域的命令也是类似的 (az eventgrid domain update)。The command for updating an existing domain is similar (az eventgrid domain update).

支持的目标和 RBAC 角色Supported destinations and RBAC roles

为事件网格主题或域启用标识后,Azure 会自动在 Azure Active Directory 中创建标识。After you enable identity for your event grid topic or domain, Azure automatically creates an identity in Azure Active Directory. 将此标识添加到适当的 Azure 角色,使主题或域可以将事件转发到受支持的目标。Add this identity to appropriate Azure roles so that the topic or domain can forward events to supported destinations. 例如,将标识添加到 Azure 事件中心命名空间的“Azure 事件中心数据发送方”角色,使事件网格主题可以将事件转发到该命名空间中的事件中心。For example, add the identity to the Azure Event Hubs Data Sender role for an Azure Event Hubs namespace so that the event grid topic can forward events to event hubs in that namespace.

当前,Azure 事件网格支持配置有系统分配的托管标识的主题或域,允许将事件转发到以下目标。Currently, Azure event grid supports topics or domains configured with a system-assigned managed identity to forward events to the following destinations. 此表还为你提供标识应位于的角色,以便主题可以转发事件。This table also gives you the roles that the identity should be in so that the topic can forward the events.

目标Destination RBAC 角色RBAC role
服务总线队列和主题Service Bus queues and topics Azure 服务总线数据发送方Azure Service Bus Data Sender
Azure 事件中心Azure Event Hubs Azure 事件中心数据发送方Azure Event Hubs Data Sender
Azure Blob 存储Azure Blob storage 存储 Blob 数据参与者Storage Blob Data Contributor
Azure 队列存储Azure Queue storage 存储队列数据消息发送方Storage Queue Data Message Sender

向目标上的 RBAC 角色添加标识Add an identity to RBAC roles on destinations

本部分介绍如何将主题或域的标识添加到 RBAC 角色。This section describes how to add the identity for your topic or domain to an RBAC role.

使用 Azure 门户Use the Azure portal

你可以使用 Azure 门户将主题或域标识分配给相应的角色,让主题或域可以将事件转发到目标。You can use the Azure portal to assign the topic or domain identity to an appropriate role so that the topic or domain can forward events to the destination.

以下示例将名为“msitesttopic”的事件网格主题的托管标识添加到包含队列或主题资源的服务总线命名空间的“Azure 服务总线数据发送方”角色 。The following example adds a managed identity for an event grid topic named msitesttopic to the Azure Service Bus Data Sender role for a Service Bus namespace that contains a queue or topic resource. 在命名空间级别添加到角色时,主题可以将事件转发到命名空间中的所有实体。When you add to the role at the namespace level, the topic can forward events to all entities within the namespace.

  1. Azure 门户中,转到“服务总线命名空间”。Go to your Service Bus namespace in the Azure portal.
  2. 在左窗格中选择“访问控制”。Select Access Control in the left pane.
  3. 在“添加角色分配”部分中选择“添加” 。Select Add in the Add a role assignment section.
  4. 在“添加角色分配”页上执行以下步骤:On the Add a role assignment page, do the following steps:
    1. 选择角色。Select the role. 在本例中,它是“Azure 服务总线数据发送方”。In this case, it's Azure Service Bus Data Sender.
    2. 为主题或域选择“标识”。Select the identity for your topic or domain.
    3. 选择“保存”以保存配置。Select Save to save the configuration.

这些步骤与向表中提到的其他角色添加标识相似。The steps are similar for adding an identity to other roles mentioned in the table.

使用 Azure CLIUse the Azure CLI

本部分中的示例展示了如何使用 Azure CLI 向 RBAC 角色添加标识。The example in this section shows you how to use the Azure CLI to add an identity to an RBAC role. 示例命令适用于事件网格主题。The sample commands are for event grid topics. 适用于事件网格域的命令也是类似的。The commands for event grid domains are similar.

获取主题的系统标识的主体 IDGet the principal ID for the topic's system identity

首先,获取主题的系统托管标识的主体 ID,并将该标识分配给相应的角色。First, get the principal ID of the topic's system-managed identity and assign the identity to appropriate roles.

topic_pid=$(az ad sp list --display-name "$<TOPIC NAME>" --query [].objectId -o tsv)

在不同范围内创建事件中心的角色分配Create a role assignment for event hubs at various scopes

以下 CLI 示例演示如何在命名空间级别或事件中心级别将主题的标识添加到“Azure 事件中心数据发送方”角色。The following CLI example shows how to add a topic's identity to the Azure Event Hubs Data Sender role at the namespace level or at the event hub level. 如果在命名空间级别创建角色分配,则主题可以将事件转发到该命名空间中的所有事件中心。If you create the role assignment at the namespace level, the topic can forward events to all event hubs in that namespace. 如果在事件中心级别创建角色分配,则主题只能将事件转发到该特定的事件中心。If you create a role assignment at the event hub level, the topic can forward events only to that specific event hub.

role="Azure Event Hubs Data Sender" 
namespaceresourceid=$(az eventhubs namespace show -n $<EVENT HUBS NAMESPACE NAME> -g <RESOURCE GROUP of EVENT HUB> --query "{I:id}" -o tsv) 
eventhubresourceid=$(az eventhubs eventhub show -n <EVENT HUB NAME> --namespace-name <EVENT HUBS NAMESPACE NAME> -g <RESOURCE GROUP of EVENT HUB> --query "{I:id}" -o tsv) 

# create role assignment for the whole namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$namespaceresourceid" 

# create role assignment scoped to just one event hub inside the namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$eventhubresourceid" 

在不同的范围内创建服务总线主题的角色分配Create a role assignment for a Service Bus topic at various scopes

以下 CLI 示例演示如何在命名空间级别或服务总线主题级别将主题的标识添加到“Azure 服务总线数据发送方”角色。The following CLI example shows how to add a topic's identity to the Azure Service Bus Data Sender role at the namespace level or at the Service Bus topic level. 如果在命名空间级别创建角色分配,则事件网格主题可以将事件转发到该命名空间中的所有实体(服务总线队列或主题)。If you create the role assignment at the namespace level, the event grid topic can forward events to all entities (Service Bus queues or topics) within that namespace. 如果在服务总线队列或主题级别创建角色分配,则事件网格主题只能将事件转发到该特定的服务总线队列或主题。If you create a role assignment at the Service Bus queue or topic level, the event grid topic can forward events only to that specific Service Bus queue or topic.

role="Azure Service Bus Data Sender" 
namespaceresourceid=$(az servicebus namespace show -n $RG\SB -g "$RG" --query "{I:id}" -o tsv 
sbustopicresourceid=$(az servicebus topic show -n topic1 --namespace-name $RG\SB -g "$RG" --query "{I:id}" -o tsv) 

# create role assignment for the whole namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$namespaceresourceid" 

# create role assignment scoped to just one hub inside the namespace 
az role assignment create --role "$role" --assignee "$topic_pid" --scope "$sbustopicresourceid" 

创建使用标识的事件订阅Create event subscriptions that use an identity

在你的主题或域有了系统托管标识并且你已将该标识添加到目标上的相应角色后,你就可以创建使用该标识的订阅了。After you have a topic or a domain with a system-managed identity and have added the identity to the appropriate role on the destination, you're ready to create subscriptions that use the identity.

使用 Azure 门户Use the Azure portal

创建事件订阅时,你会在“终结点详细信息”部分看到一个选项,启用该选项即可使用该部分中的终结点的系统托管标识。When you create an event subscription, you see an option to enable the use of a system-assigned identity for an endpoint in the ENDPOINT DETAILS section.

在为服务总线队列创建事件订阅时启用标识

还可以在“附加功能”选项卡上启用将系统分配的标识用于死信的功能。You can also enable using a system-assigned identity to be used for dead-lettering on the Additional Features tab.

为死信启用系统分配的标识

使用 Azure CLI - 服务总线队列Use the Azure CLI - Service Bus queue

本部分介绍如何使用 Azure CLI 启用系统分配的标识,以将事件传送到服务总线队列。In this section, you learn how to use the Azure CLI to enable the use of a system-assigned identity to deliver events to a Service Bus queue. 标识必须是“Azure 服务总线数据发送方”角色的成员。The identity must be a member of the Azure Service Bus Data Sender role. 它还必须是用于死信的存储帐户上的“存储 Blob 数据参与者”角色的成员。It must also be a member of the Storage Blob Data Contributor role on the storage account that's used for dead-lettering.

定义变量Define variables

首先,指定要在 CLI 命令中使用的以下变量的值。First, specify values for the following variables to be used in the CLI command.

subid="<AZURE SUBSCRIPTION ID>"
rg = "<RESOURCE GROUP of EVENT GRID TOPIC>"
topicname = "<EVENT GRID TOPIC NAME>"

# get the service bus queue resource id
queueid=$(az servicebus queue show --namespace-name <SERVICE BUS NAMESPACE NAME> --name <QUEUE NAME> --resource-group <RESOURCE GROUP NAME> --query id --output tsv)
sb_esname = "<Specify a name for the event subscription>" 

使用托管标识创建用于传送的事件订阅Create an event subscription by using a managed identity for delivery

此示例命令为终结点类型设置为“服务总线队列”的事件网格主题创建事件订阅。This sample command creates an event subscription for an event grid topic with an endpoint type set to Service Bus queue.

az eventgrid event-subscription create  
    --source-resource-id /subscriptions/$subid/resourceGroups/$rg/providers/Microsoft.EventGrid/topics/$topicname
    --delivery-identity-endpoint-type servicebusqueue  
    --delivery-identity systemassigned 
    --delivery-identity-endpoint $queueid
    -n $sb_esname 

使用托管标识创建用于传送和死信的事件订阅Create an event subscription by using a managed identity for delivery and dead-lettering

此示例命令为终结点类型设置为“服务总线队列”的事件网格主题创建事件订阅。This sample command creates an event subscription for an event grid topic with an endpoint type set to Service Bus queue. 它还指定将系统托管标识用于死信。It also specifies that the system-managed identity is to be used for dead-lettering.

storageid=$(az storage account show --name demoStorage --resource-group gridResourceGroup --query id --output tsv)
deadletterendpoint="$storageid/blobServices/default/containers/<BLOB CONTAINER NAME>"

az eventgrid event-subscription create  
    --source-resource-id /subscriptions/$subid/resourceGroups/$rg/providers/Microsoft.EventGrid/topics/$topicname 
    --delivery-identity-endpoint-type servicebusqueue
    --delivery-identity systemassigned 
    --delivery-identity-endpoint $queueid
    --deadletter-identity-endpoint $deadletterendpoint 
    --deadletter-identity systemassigned 
    -n $sb_esnameq 

使用 Azure CLI - 事件中心Use the Azure CLI - Event Hubs

本部分介绍如何使用 Azure CLI 启用系统分配的标识,以将事件传送到事件中心。In this section, you learn how to use the Azure CLI to enable the use of a system-assigned identity to deliver events to an event hub. 该标识必须是“Azure 事件中心数据发送方”角色的成员。The identity must be a member of the Azure Event Hubs Data Sender role. 它还必须是用于死信的存储帐户上的“存储 Blob 数据参与者”角色的成员。It must also be a member of the Storage Blob Data Contributor role on the storage account that's used for dead-lettering.

定义变量Define variables

subid="<AZURE SUBSCRIPTION ID>"
rg = "<RESOURCE GROUP of EVENT GRID TOPIC>"
topicname = "<EVENT GRID TOPIC NAME>"

hubid=$(az eventhubs eventhub show --name <EVENT HUB NAME> --namespace-name <NAMESPACE NAME> --resource-group <RESOURCE GROUP NAME> --query id --output tsv)
eh_esname = "<SPECIFY EVENT SUBSCRIPTION NAME>" 

使用托管标识创建用于传送的事件订阅Create an event subscription by using a managed identity for delivery

此示例命令为终结点类型设置为“事件中心”的事件网格主题创建事件订阅。This sample command creates an event subscription for an event grid topic with an endpoint type set to Event Hubs.

az eventgrid event-subscription create  
    --source-resource-id /subscriptions/$subid/resourceGroups/$rg/providers/Microsoft.EventGrid/topics/$topicname 
    --delivery-identity-endpoint-type eventhub 
    --delivery-identity systemassigned 
    --delivery-identity-endpoint $hubid
    -n $sbq_esname 

使用托管标识创建用于传送和死信的事件订阅Create an event subscription by using a managed identity for delivery + deadletter

此示例命令为终结点类型设置为“事件中心”的事件网格主题创建事件订阅。This sample command creates an event subscription for an event grid topic with an endpoint type set to Event Hubs. 它还指定将系统托管标识用于死信。It also specifies that the system-managed identity is to be used for dead-lettering.

storageid=$(az storage account show --name demoStorage --resource-group gridResourceGroup --query id --output tsv)
deadletterendpoint="$storageid/blobServices/default/containers/<BLOB CONTAINER NAME>"

az eventgrid event-subscription create
    --source-resource-id /subscriptions/$subid/resourceGroups/$rg/providers/Microsoft.EventGrid/topics/$topicname 
    --delivery-identity-endpoint-type servicebusqueue  
    --delivery-identity systemassigned 
    --delivery-identity-endpoint $hubid
    --deadletter-identity-endpoint $eh_deadletterendpoint
    --deadletter-identity systemassigned 
    -n $eh_esname 

使用 Azure CLI - Azure 存储队列Use the Azure CLI - Azure Storage queue

本部分介绍如何使用 Azure CLI 启用系统分配的标识,以将事件传送到 Azure 存储队列。In this section, you learn how to use the Azure CLI to enable the use of a system-assigned identity to deliver events to an Azure Storage queue. 该标识必须是存储帐户上“存储 Blob 数据参与者”角色的成员。The identity must be a member of the Storage Blob Data Contributor role on the storage account.

定义变量Define variables

subid="<AZURE SUBSCRIPTION ID>"
rg = "<RESOURCE GROUP of EVENT GRID TOPIC>"
topicname = "<EVENT GRID TOPIC NAME>"

# get the storage account resource id
storageid=$(az storage account show --name <STORAGE ACCOUNT NAME> --resource-group <RESOURCE GROUP NAME> --query id --output tsv)

# build the resource id for the queue
queueid="$storageid/queueservices/default/queues/<QUEUE NAME>" 

sa_esname = "<SPECIFY EVENT SUBSCRIPTION NAME>" 

使用托管标识创建用于传送的事件订阅Create an event subscription by using a managed identity for delivery

az eventgrid event-subscription create 
    --source-resource-id /subscriptions/$subid/resourceGroups/$rg/providers/Microsoft.EventGrid/topics/$topicname 
    --delivery-identity-endpoint-type storagequeue  
    --delivery-identity systemassigned 
    --delivery-identity-endpoint $queueid
    -n $sa_esname 

使用托管标识创建用于传送和死信的事件订阅Create an event subscription by using a managed identity for delivery + deadletter

storageid=$(az storage account show --name demoStorage --resource-group gridResourceGroup --query id --output tsv)
deadletterendpoint="$storageid/blobServices/default/containers/<BLOB CONTAINER NAME>"

az eventgrid event-subscription create  
    --source-resource-id /subscriptions/$subid/resourceGroups/$rg/providers/Microsoft.EventGrid/topics/$topicname 
    --delivery-identity-endpoint-type storagequeue  
    --delivery-identity systemassigned 
    --delivery-identity-endpoint $queueid
    --deadletter-identity-endpoint $deadletterendpoint 
    --deadletter-identity systemassigned 
    -n $sa_esname 

后续步骤Next steps

有关托管服务标识的详细信息,请参阅什么是 Azure 资源的托管标识For more information about managed service identities, see What are managed identities for Azure resources.