Veritas NetBackup™ CloudPoint インストールおよびアップグレードガイド

Microsoft Azure でのアクセス権の設定

CloudPoint で Microsoft Azure 資産を保護できるようにするには、事前に Microsoft Azure 資産へのアクセス権が必要です。CloudPoint ユーザーが Azure 資産と連携するために使用できるカスタム役割を関連付ける必要があります。

次のことを CloudPoint に可能にするカスタム役割の定義を、以下に JSON 形式で示します。

{ "Name": "CloudPoint Admin",
"IsCustom": true,
"Description": "Necessary permissions for
Azure plug-in operations in CloudPoint",
"Actions": [
"Microsoft.Storage/*/read",
"Microsoft.Compute/*/read",
"Microsoft.Sql/*/read",
"Microsoft.Compute/disks/write",
"Microsoft.Compute/disks/delete",
"Microsoft.Compute/disks/beginGetAccess/action",
"Microsoft.Compute/disks/endGetAccess/action",
"Microsoft.Compute/images/write",
"Microsoft.Compute/images/delete",
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/beginGetAccess/action",
"Microsoft.Compute/snapshots/endGetAccess/action",
"Microsoft.Compute/virtualMachines/capture/action",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Compute/virtualMachines/generalize/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Compute/virtualMachines/runCommand/action",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/vmSizes/read",
"Microsoft.Compute/virtualMachines/powerOff/action",
"Microsoft.Network/*/read",
"Microsoft.Network/networkInterfaces/delete",
"Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
"Microsoft.Network/networkInterfaces/join/action",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Network/networkSecurityGroups/join/action",
"Microsoft.Network/networkSecurityGroups/securityRules/write",
"Microsoft.Network/networkSecurityGroups/write",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/publicIPAddresses/join/action",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/routeTables/join/action",
"Microsoft.Network/virtualNetworks/delete",
"Microsoft.Network/virtualNetworks/subnets/delete",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Resources/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/write",
"Microsoft.Resources/subscriptions/resourceGroups/ \
validateMoveResources/action",
"Microsoft.Resources/subscriptions/tagNames/tagValues/write",
"Microsoft.Resources/subscriptions/tagNames/write",
"Microsoft.Subscription/*/read",
"Microsoft.Authorization/locks/*",
"Microsoft.Authorization/*/read" ],
"NotActions": [ ],
"AssignableScopes": [ 
"/subscriptions/subscription_GUID", 
"/subscriptions/subscription_GUID/ \
resourceGroups/myCloudPointGroup" ] }

CloudPoint 拡張機能が Azure の管理対象 Kubernetes クラスタにインストールされている場合は、プラグインを構成する前に次の権限も追加できます。

"Microsoft.ContainerService/managedClusters/agentPools/read",
"Microsoft.ContainerService/managedClusters/read",
"Microsoft.Compute/virtualMachineScaleSets/write",
"Microsoft.Compute/virtualMachineScaleSets/delete/action

Powershell を使用してカスタム役割を作成するには、次の Azure マニュアルの手順に従ってください。

https://docs.microsoft.com/ja-jp/azure/role-based-access-control/tutorial-custom-role-powershell

次に例を示します。

New-AzureRmRoleDefinition -InputFile "C:\CustomRoles\ReaderSupportRole.json"

Azure CLI を使用してカスタム役割を作成するには、次の Azure マニュアルの手順に従ってください。

https://docs.microsoft.com/ja-jp/azure/role-based-access-control/tutorial-custom-role-cli

次に例を示します。

az role definition create --role-definition "~/CustomRoles/
ReaderSupportRole.json"

この役割を使用するには、次の手順を実行します。