问题描述
在使用APIM服务中，需要为专门的一组用户赋予特殊的权限：审批APIM用户的对产品的订阅。需要自定义一个RBAC角色，那么如何来设置最少的Action满足需求呢？
问题解答
要对APIM订阅进行审批，至少需要 Microsoft.ApiManagement/service/subscriptions/write （对subscriptions的write权限）。同时，也需要有APIM资源，当前资源组，Subscriptions的Read权限。所以总起来就是需要以下Actions：
- Microsoft.ApiManagement/service/subscriptions/write
- Microsoft.ApiManagement/service/subscriptions/read
- Microsoft.Resources/subscriptions/resourceGroups/read
- Microsoft.ApiManagement/service/read
当需要在Azure门户上创建自定义RBAC 角色时候，自定义JSON内容为：
{ "properties": { "roleName": "APIM Only Approval Subscription User", "description": "APIM Only Approval Subscription User", "assignableScopes": [ "/subscriptions/<your azure subscription ID>" ], "permissions": [ { "actions": [ "Microsoft.ApiManagement/service/subscriptions/write", "Microsoft.ApiManagement/service/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.ApiManagement/service/read" ], "notActions": [], "dataActions": [], "notDataActions": [] } ] } }
创建成功后，效果如下：
参考资料
使用 Azure 门户创建 Azure 自定义角色 ： https://docs.microsoft.com/zh-cn/azure/role-based-access-control/custom-roles-portal
