一个人如何从一个润色簿访问不同的订阅

Question

目前，我有两个订阅：S01和S02。我有一个在S02中运行的需要访问S01资源的Runbook。

当我运行命令Get-AzureRmSubscription -SubscriptionName S01时，它甚至无法找到订阅。下面是代码和输出的例子：

$connectionName = "AzureRunAsConnection" 
try 
{ 
    # Get the connection "AzureRunAsConnection " 
    $servicePrincipalConnection = Get-AutomationConnection -Name $connectionName   

    Write-Output "Logging in to Azure..." 
    $Account = Add-AzureRmAccount ` 
     -ServicePrincipal ` 
     -TenantId $servicePrincipalConnection.TenantId ` 
     -ApplicationId $servicePrincipalConnection.ApplicationId ` 
     -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint ` 
     -Verbose ` 
     -ErrorAction Stop 

    Write-Output "***** LOGGED IN ($((Get-AzureRmContext).Subscription.SubscriptionName)). *******" 
} 
catch { 
    if (!$servicePrincipalConnection) 
    { 
     $ErrorMessage = "Connection $connectionName not found." 
     throw $ErrorMessage 
    } 
    else 
    { 
     Write-Error -Message $_.Exception 
     throw $_.Exception 
    } 
} 

Write-Output "Current subscription using Get-AzureRmSubscription:" 
Get-AzureRmSubscription 
Write-Output "===============================================================" 

Write-Output "Switch subscription using Select-AzureRmSubscription:" 
Get-AzureRmSubscription -SubscriptionName "S01" | Select-AzureRmSubscription 
Write-Output "===============================================================" 

Write-Output "Switch subscription using Set-AzureRmContext:" 
Set-AzureRmContext -SubscriptionName "S01" 
Write-Output "===============================================================" 

输出：

Logging in to Azure... 

VERBOSE: Performing the operation "log in" on target "ServicePrincipal account in environment 'AzureCloud'". 

***** LOGGED IN (S02). ******* 

Current subscription using Get-AzureRmSubscription: 

WARNING: Unable to acquire token for tenant 'Common' 

SubscriptionId   : 2f301a20-22a3-b321-2a3c-829ac3d4e39a 
SubscriptionName   : S02 
State      : Enabled 
TenantId     : e2g374a3-8732-3466-9876-a7cd32b208de 
CurrentStorageAccountName : 

=============================================================== 

Switch subscription using Select-AzureRmSubscription: 

WARNING: Unable to acquire token for tenant 'Common' 

ERROR: Get-AzureRmSubscription : Subscription S01 was not found in tenant . Please verify that the subscription 
exists in this tenant. 
At line:37 char:2 
+ Get-AzureRmSubscription -SubscriptionName "S01" | Sele ... 
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : CloseError: (:) [Get-AzureRmSubscription], PSArgumentException 
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.GetAzureRMSubscriptionCommand 


=============================================================== 

Switch subscription using Set-AzureRmContext: 

ERROR: Set-AzureRmContext : Provided subscription S01 does not exist 
At line:41 char:2 
+ Set-AzureRmContext -SubscriptionName "S01" 
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : CloseError: (:) [Set-AzureRmContext], ArgumentException 
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand 


=============================================================== 

我想这一切都是围绕着AzureRunAsConnection和AzureRunAsCertificate并使用ServicePrincipal。我的猜测是，我需要使用S01的AzureRunAsConnect登录，我假设我需要将证书从S01中取出并存入S02，但我没有太多的运气将S01中的RunAsCertificate导出并导入到S02中。

我试着创建自己的AD应用程序，但我似乎无法得到那个工作。

我相信它必须是可能的，但是怎么样？我关闭了，什么是正确的方法？

P.S.两份订阅都“共享”相同的Azure AD。

TIA

Answer 1

您无法将一次分配的证书导出到服务主管。所以，你有两个选择：

1. 创建一个证书的新服务主体和使用相同的证书两种订阅
2. 如果您有现有的服务主体的证书的副本，然后用它来验证你的第二个天青订阅。

无论哪种方法你选择，你应该看看这里一步创建服务主体，证书等：https://docs.microsoft.com/en-us/azure/automation/automation-sec-configure-azure-runas-account#update-an-automation-account-using-powershell