使用网络观察程序功能所需的 Azure 基于角色的访问控制权限Azure role-based access control permissions required to use Network Watcher capabilities

通过 Azure 基于角色的访问控制 (Azure RBAC),你可以将具体操作仅分配给需要完成其分配的职责的组织成员。Azure role-based access control (Azure RBAC) enables you to assign only the specific actions to members of your organization that they require to complete their assigned responsibilities. 若要使用网络观察程序功能,登录 Azure 所使用的帐户必须分配给所有者参与者网络参与者内置角色,或分配给自定义角色(已向自定义角色分配了以下各节中为每个网络观察程序功能列出的操作)。To use Network Watcher capabilities, the account you log into Azure with, must be assigned to the Owner, Contributor, or Network contributor built-in roles, or assigned to a custom role that is assigned the actions listed for each Network Watcher capability in the sections that follow. 若要了解有关网络观察程序的功能的详细信息,请参阅什么是网络观察程序?To learn more about Network Watcher's capabilities, see What is Network Watcher?.

网络观察程序Network Watcher

操作Action 说明Description
Microsoft.Network/networkWatchers/readMicrosoft.Network/networkWatchers/read 获取网络观察程序Get a network watcher
Microsoft.Network/networkWatchers/writeMicrosoft.Network/networkWatchers/write 创建或更新网络观察程序Create or update a network watcher
Microsoft.Network/networkWatchers/deleteMicrosoft.Network/networkWatchers/delete 删除网络观察程序Delete a network watcher

NSG 流日志NSG flow logs

操作Action 说明Description
Microsoft.Network/networkWatchers/configureFlowLog/actionMicrosoft.Network/networkWatchers/configureFlowLog/action 配置流日志Configure a flow Log
Microsoft.Network/networkWatchers/queryFlowLogStatus/actionMicrosoft.Network/networkWatchers/queryFlowLogStatus/action 流日志的查询状态Query status for a flow log

排查连接问题Connection troubleshoot

操作Action 说明Description
Microsoft.Network/networkWatchers/connectivityCheck/actionMicrosoft.Network/networkWatchers/connectivityCheck/action 启动连接故障排除测试Initiate a connection troubleshoot test
Microsoft.Network/networkWatchers/queryTroubleshootResult/actionMicrosoft.Network/networkWatchers/queryTroubleshootResult/action 连接故障排除测试的查询结果Query results of a connection troubleshoot test
Microsoft.Network/networkWatchers/troubleshoot/actionMicrosoft.Network/networkWatchers/troubleshoot/action 运行连接故障排除测试Run a connection troubleshoot test

连接监视器Connection monitor

操作Action 说明Description
Microsoft.Network/networkWatchers/connectionMonitors/start/actionMicrosoft.Network/networkWatchers/connectionMonitors/start/action 启动连接监视器Start a connection monitor
Microsoft.Network/networkWatchers/connectionMonitors/stop/actionMicrosoft.Network/networkWatchers/connectionMonitors/stop/action 停止连接监视器Stop a connection monitor
Microsoft.Network/networkWatchers/connectionMonitors/query/actionMicrosoft.Network/networkWatchers/connectionMonitors/query/action 查询连接监视器Query a connection monitor
Microsoft.Network/networkWatchers/connectionMonitors/readMicrosoft.Network/networkWatchers/connectionMonitors/read 获取连接监视器Get a connection monitor
Microsoft.Network/networkWatchers/connectionMonitors/writeMicrosoft.Network/networkWatchers/connectionMonitors/write 创建连接监视器Create a connection monitor
Microsoft.Network/networkWatchers/connectionMonitors/deleteMicrosoft.Network/networkWatchers/connectionMonitors/delete 删除连接监视器Delete a connection monitor

数据包捕获Packet capture

操作Action 说明Description
Microsoft.Network/networkWatchers/packetCaptures/queryStatus/actionMicrosoft.Network/networkWatchers/packetCaptures/queryStatus/action 查询数据包捕获的状态Query the status of a packet capture
Microsoft.Network/networkWatchers/packetCaptures/stop/actionMicrosoft.Network/networkWatchers/packetCaptures/stop/action 停止数据包捕获Stop a packet capture
Microsoft.Network/networkWatchers/packetCaptures/readMicrosoft.Network/networkWatchers/packetCaptures/read 获取数据包捕获Get a packet capture
Microsoft.Network/networkWatchers/packetCaptures/writeMicrosoft.Network/networkWatchers/packetCaptures/write 创建数据包捕获Create a packet capture
Microsoft.Network/networkWatchers/packetCaptures/deleteMicrosoft.Network/networkWatchers/packetCaptures/delete 删除数据包捕获Delete a packet capture

IP 流验证IP flow verify

操作Action 说明Description
Microsoft.Network/networkWatchers/ipFlowVerify/actionMicrosoft.Network/networkWatchers/ipFlowVerify/action 验证 IP 流Verify an IP flow

下一跃点Next hop

操作Action 说明Description
Microsoft.Network/networkWatchers/nextHop/actionMicrosoft.Network/networkWatchers/nextHop/action 从 VM 获取下一跃点Get the next hop from a VM

网络安全组视图Network security group view

操作Action 说明Description
Microsoft.Network/networkWatchers/securityGroupView/actionMicrosoft.Network/networkWatchers/securityGroupView/action 查看安全组View security groups

拓扑Topology

操作Action 说明Description
Microsoft.Network/networkWatchers/topology/actionMicrosoft.Network/networkWatchers/topology/action 获取拓扑Get topology

可访问性报表Reachability report

操作Action 说明Description
Microsoft.Network/networkWatchers/azureReachabilityReport/actionMicrosoft.Network/networkWatchers/azureReachabilityReport/action 获取 Azure 可访问性报表Get an Azure reachability report

其他操作Additional actions

网络观察程序功能还需要以下操作:Network Watcher capabilities also require the following actions:

操作Action(s) 说明Description
Microsoft.Authorization/*/ReadMicrosoft.Authorization/*/Read 用于提取 Azure 角色分配和策略定义Used to fetch Azure role assignments and policy definitions
Microsoft.Resources/subscriptions/resourceGroups/ReadMicrosoft.Resources/subscriptions/resourceGroups/Read 用于枚举订阅中的所有资源组Used to enumerate all the resource groups in a subscription
Microsoft.Storage/storageAccounts/ReadMicrosoft.Storage/storageAccounts/Read 用于获取指定存储帐户的属性Used to get the properties for the specified storage account
Microsoft.Storage/storageAccounts/listServiceSas/Action,Microsoft.Storage/storageAccounts/listServiceSas/Action,
Microsoft.Storage/storageAccounts/listAccountSas/Action,Microsoft.Storage/storageAccounts/listAccountSas/Action,
Microsoft.Storage/storageAccounts/listKeys/ActionMicrosoft.Storage/storageAccounts/listKeys/Action
用于获取共享访问签名 (SAS),启用对存储帐户的安全访问并写入存储帐户Used to fetch shared access signatures (SAS) enabling secure access to storage account and write to the storage account
Microsoft.Compute/virtualMachines/Read,Microsoft.Compute/virtualMachines/Read,
Microsoft.Compute/virtualMachines/WriteMicrosoft.Compute/virtualMachines/Write
用于登录到 VM、执行数据包捕获,并将其上传到存储帐户Used to log in to the VM, do a packet capture and upload it to storage account
Microsoft.Compute/virtualMachines/extensions/ReadMicrosoft.Compute/virtualMachines/extensions/Read
Microsoft.Compute/virtualMachines/extensions/WriteMicrosoft.Compute/virtualMachines/extensions/Write
用于检查网络观察程序扩展是否存在,并在需要时进行安装Used to check if Network Watcher extension is present, and install if required
Microsoft.Compute/virtualMachineScaleSets/Read,Microsoft.Compute/virtualMachineScaleSets/Read,
Microsoft.Compute/virtualMachineScaleSets/WriteMicrosoft.Compute/virtualMachineScaleSets/Write
用于访问虚拟机规模集、执行数据包捕获并将其上传到存储帐户Used to access virtual machine scale sets, do packet captures and upload them to storage account
Microsoft.Compute/virtualMachineScaleSets/extensions/Read,Microsoft.Compute/virtualMachineScaleSets/extensions/Read,
Microsoft.Compute/virtualMachineScaleSets/extensions/WriteMicrosoft.Compute/virtualMachineScaleSets/extensions/Write
用于检查网络观察程序扩展是否存在,并在需要时进行安装Used to check if Network Watcher extension is present, and install if required
Microsoft.Insights/alertRules/*Microsoft.Insights/alertRules/* 用于设置指标警报Used to set up metric alerts
Microsoft.Support/*Microsoft.Support/* 用于从网络观察程序创建和更新支持票证Used to create and update support tickets from Network Watcher