An enterprise cloud infrastructure is configured with the following hierarchy:
- Management Group: `Corp-MG`
- Subscription: `Sub-Production`
- Resource Group: `RG-AppStore`
- Resource Group: `RG-DataStore`
You are tasked with assigning Azure Role-Based Access Control (RBAC) roles to security groups to align with the principle of least privilege. Match each security group to the correct Azure RBAC role and scope assignment based on their technical requirements.
- GroupA: Must be able to create and manage all resources within `RG-AppStore`, but must not be able to modify resource configurations in `RG-DataStore` or delegate access to other users.Contributor role assigned at the `RG-AppStore` scope
- GroupB: Must be able to view all resource configurations across all subscriptions under `Corp-MG` and create support requests for any issues, but must not be able to modify any resources.Reader and Support Request Contributor roles assigned at the `Corp-MG` scope
- GroupC: Must be able to manage user access, assign RBAC roles, and manage resource locks across the entire `Sub-Production` subscription, without having permissions to modify the virtual machines or databases directly.User Access Administrator role assigned at the `Sub-Production` scope
Cevap
GroupA matches the Contributor role at the `RG-AppStore` scope. GroupB matches the Reader and Support Request Contributor roles at the `Corp-MG` scope. GroupC matches the User Access Administrator role at the `Sub-Production` scope.
The correct mapping assigns the minimum required role (Contributor, Reader + Support Request Contributor, or User Access Administrator) at the narrowest scope that covers the requirement (resource group, management group, or subscription, respectively).
Adım Adım Çözüm
Anahtar Kavram
Assigning Azure RBAC roles at various scopes based on the principle of least privilege.
Tahmini Süre:2m 0s