NetBackup™ Snapshot Manager インストールおよびアップグレードガイド

Microsoft Azure Stack Hub でのアクセス権の設定

NetBackup Snapshot Manager で Microsoft Azure Stack 資産を保護できるようにするには、事前に Microsoft Azure Stack 資産へのアクセス権が必要です。NetBackup Snapshot Manager ユーザーが Azure Stack 資産と連携するために使用できるカスタム役割を関連付ける必要があります。

次のことを NetBackup Snapshot Manager に可能にするカスタム役割の定義を、以下に JSON 形式で示します。

 {
    "properties": {
        "roleName": "snapshot-manager-role",
        "description": "Necessary permissions for Azure plug-in operations in CloudPoint",
        "assignableScopes": [
            "/subscriptions/<SusbcriptionName>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Storage/*/read",
                    "Microsoft.Compute/*/read",
                    "Microsoft.Sql/*/read",
                    "Microsoft.Compute/disks/write",
                    "Microsoft.Compute/disks/delete",
                    "Microsoft.Compute/disks/beginGetAccess/action",
                    "Microsoft.Compute/disks/endGetAccess/action",
                    "Microsoft.Compute/snapshots/delete",
                    "Microsoft.Compute/snapshots/write",
                    "Microsoft.Compute/snapshots/beginGetAccess/action",
                    "Microsoft.Compute/snapshots/endGetAccess/action",
                    "Microsoft.Compute/virtualMachines/write",
                    "Microsoft.Compute/virtualMachines/delete",
                    "Microsoft.Compute/virtualMachines/start/action",
                    "Microsoft.Compute/virtualMachines/vmSizes/read",
                    "Microsoft.Compute/virtualMachines/powerOff/action",
                    "Microsoft.Network/*/read",
                    "Microsoft.Network/networkInterfaces/delete",
                    "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
                    "Microsoft.Network/networkInterfaces/join/action",
                    "Microsoft.Network/networkInterfaces/write",
                    "Microsoft.Network/networkSecurityGroups/join/action",
                    "Microsoft.Network/networkSecurityGroups/write",
                    "Microsoft.Network/publicIPAddresses/delete",
                    "Microsoft.Network/publicIPAddresses/join/action",
                    "Microsoft.Network/publicIPAddresses/write",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.Resources/*/read",
                    "Microsoft.Resources/subscriptions/tagNames/tagValues/write",
                    "Microsoft.Resources/subscriptions/tagNames/write",
                    "Microsoft.Subscription/*/read",
                    "Microsoft.Authorization/locks/*",
                    "Microsoft.Authorization/*/read",
                    "Microsoft.ContainerService/managedClusters/agentPools/read",
                    "Microsoft.ContainerService/managedClusters/read",
                    "Microsoft.Compute/virtualMachineScaleSets/write",
                    "Microsoft.Compute/virtualMachineScaleSets/delete/action",
                    "Microsoft.Compute/restorePointCollections/read",
                    "Microsoft.Compute/restorePointCollections/write",
                    "Microsoft.Compute/restorePointCollections/delete",
                    "Microsoft.Compute/restorePointCollections/restorePoints/read",
                    "Microsoft.Compute/restorePointCollections/restorePoints/write",
                    "Microsoft.Compute/restorePointCollections/restorePoints/delete",
                    "Microsoft.Compute/restorePointCollections/restorePoints/retrieveSasUris/action",
                    "Microsoft.Compute/restorePointCollections/restorePoints/diskRestorePoints/read",
                    "Microsoft.Compute/restorePointCollections/restorePoints/diskRestorePoints/beginGetAccess/action",
                    "Microsoft.Compute/restorePointCollections/restorePoints/diskRestorePoints/endGetAccess/action"

                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Powershell を使用してカスタム役割を作成するには、Azure Satck マニュアルの手順に従ってください。

次に例を示します。

New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json"

Azure CLI を使用してカスタム役割を作成するには、Azure マニュアルの手順に従ってください。

次に例を示します。

az role definition create --role-definition "~/CustomRoles/
registrationrole.json"

この役割を使用するには、次の手順を実行します。