您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

教程:基于蓝图示例创建环境Tutorial: Create an environment from a blueprint sample

示例蓝图示范了 Azure 蓝图的功能。Sample blueprints provide examples of what can be done using Azure Blueprints. 每个示例蓝图附带具体的意图或目的,但其本身无法创建完整的环境。Each is a sample with a specific intent or purpose, but doesn't create a complete environment by themselves. 每个示例蓝图旨在用作探索 Azure 蓝图的起点,其中带有包含的项目、设计和参数的各种组合。Each is intended as a starting place to explore using Azure Blueprints with various combinations of included artifacts, designs, and parameters.

以下教程使用“采用 RBAC 的资源组”蓝图示例来展示 Azure 蓝图服务的各个方面。 The following tutorial uses the Resource Groups with RBAC blueprint sample to showcase different aspects of the Azure Blueprints service. 本文包括以下步骤:The following steps are covered:

  • 基于示例创建新的蓝图定义Create a new blueprint definition from the sample
  • 将示例副本标记为“已发布” Mark your copy of the sample as Published
  • 将蓝图副本分配到现有的订阅Assign your copy of the blueprint to an existing subscription
  • 检查要分配的已部署资源Inspect deployed resources for the assignment
  • 取消分配蓝图以删除锁Unassign the blueprint to remove the locks

先决条件Prerequisites

若要完成本教程,需要一个 Azure 订阅。To complete this tutorial, an Azure subscription is needed. 如果没有 Azure 订阅,请在开始之前创建一个免费帐户If you don't have an Azure subscription, create a free account before you begin.

基于示例创建蓝图定义Create blueprint definition from sample

首先实施蓝图示例。First, implement the blueprint sample. 通过导入可以基于示例在环境中创建新的蓝图。Importing creates a new blueprint in your environment based on the sample.

  1. 在左侧窗格中,选择“所有服务” 。Select All services in the left pane. 搜索并选择“蓝图”。Search for and select Blueprints.

  2. 在左侧的“开始”页中,选择“创建蓝图”下的“创建”按钮。 From the Getting started page on the left, select the Create button under Create a blueprint.

  3. 在“其他示例”下找到“采用 RBAC 的资源组”蓝图示例,并选择它。 Find the Resource Groups with RBAC blueprint sample under Other Samples and select it.

  4. 输入该蓝图示例的“基本信息”: Enter the Basics of the blueprint sample:

    • 蓝图名称:提供蓝图示例副本的名称。Blueprint name: Provide a name for your copy of the blueprint sample. 本教程使用名称 two-rgs-with-role-assignmentsFor this tutorial, we'll use the name two-rgs-with-role-assignments.
    • 定义位置:使用省略号并选择要将示例副本保存到的管理组或订阅。Definition location: Use the ellipsis and select the management group or subscription to save your copy of the sample to.
  5. 选择页面顶部的“项目”选项卡,或页面底部的“下一步: 项目”。Select the Artifacts tab at the top of the page or Next: Artifacts at the bottom of the page.

  6. 查看构成蓝图示例的项目列表。Review the list of artifacts that make up the blueprint sample. 本示例定义两个资源组,其显示名称为 ProdRGPreProdRGThis sample defines two resource groups, with display names of ProdRG and PreProdRG. 在蓝图分配期间,将设置每个资源组的最终名称和位置。The final name and location of each resource group are set during blueprint assignment. ProdRG 资源组分配“参与者”角色,为 PreProdRG 资源组分配“所有者”和“读取者”角色。 The ProdRG resource group is assigned the Contributor role and the PreProdRG resource group is assigned the Owner and Readers roles. 定义中分配的角色是静态的,但分配有角色的用户、应用或组是在蓝图分配期间设置的。The roles assigned in the definition are static, but user, app, or group that is assigned the role is set during blueprint assignment.

  7. 查看完蓝图示例后,选择“保存草稿”。 Select Save Draft when you've finished reviewing the blueprint sample.

此步骤在选定的管理组或订阅中创建示例蓝图定义的副本。This step creates a copy of the sample blueprint definition in the selected management group or subscription. 对已保存的蓝图定义的管理方式类似于从头开始创建的任何蓝图。The saved blueprint definition is managed like any blueprint created from scratch. 可将示例保存到管理组或订阅任意次。You may save the sample to your management group or subscription as many times as needed. 但是,必须为每个副本提供唯一的名称。However, each copy must be provided a unique name.

“保存蓝图定义成功”门户通知出现后,转到下一步骤。 Once the Saving blueprint definition succeeded portal notification appears, move to the next step.

发布示例副本Publish the sample copy

现已在环境中创建蓝图示例的副本。Your copy of the blueprint sample has now been created in your environment. 该副本在创建后处于“草稿”模式,必须先将其 发布,然后才能分配和部署它。 It's created in Draft mode and must be Published before it can be assigned and deployed. 可根据环境和需求自定义蓝图示例的副本。The copy of the blueprint sample can be customized to your environment and needs. 本教程不会对副本进行任何更改。For this tutorial, we won't make any changes.

  1. 在左侧窗格中,选择“所有服务” 。Select All services in the left pane. 搜索并选择“蓝图”。Search for and select Blueprints.

  2. 在左侧选择“蓝图定义”页。 Select the Blueprint definitions page on the left. 使用筛选器找到 two-rgs-with-role-assignments 蓝图定义,并将其选中。Use the filters to find the two-rgs-with-role-assignments blueprint definition and then select it.

  3. 选择页面顶部的“发布蓝图”。 Select Publish blueprint at the top of the page. 在右侧的新窗格中,输入 1.0 作为蓝图示例副本的 版本In the new pane on the right, provide Version as 1.0 for your copy of the blueprint sample. 以后做出修改时,此属性非常有用。This property is useful for if you make a modification later. 提供 更改注释,例如,“基于‘采用 RBAC 的资源组’蓝图示例发布的第一个版本”。Provide Change notes such as "First version published from the resource groups with RBAC blueprint sample." 然后选择页面底部的“发布”。 Then select Publish at the bottom of the page.

使用此步骤可将蓝图分配到订阅。This step makes it possible to assign the blueprint to a subscription. 发布后,仍可进行更改。Once published, changes can still be made. 若要进行其他更改,需要使用新的“版本”值发布,以跟踪同一蓝图定义的不同版本之间的差异。 Additional changes require publishing with a new Version value to track differences between different versions of the same blueprint definition.

“发布蓝图定义成功”门户通知出现后,转到下一步骤。 Once the Publishing blueprint definition succeeded portal notification appears, move to the next step.

分配示例副本Assign the sample copy

成功 发布 蓝图示例的副本后,可将它分配到它所在的管理组中的某个订阅。Once the copy of the blueprint sample has been successfully Published, it can be assigned to a subscription within the management group it was saved to. 在此步骤中,需提供参数来使蓝图示例副本的每个部署保持唯一。This step is where parameters are provided to make each deployment of the copy of the blueprint sample unique.

  1. 在左侧窗格中,选择“所有服务”。Select All services in the left pane. 搜索并选择“蓝图”。Search for and select Blueprints.

  2. 在左侧选择“蓝图定义”页。 Select the Blueprint definitions page on the left. 使用筛选器找到 two-rgs-with-role-assignments 蓝图定义,并将其选中。Use the filters to find the two-rgs-with-role-assignments blueprint definition and then select it.

  3. 选择蓝图定义页面顶部的“分配蓝图”。 Select Assign blueprint at the top of the blueprint definition page.

  4. 提供蓝图分配的参数值:Provide the parameter values for the blueprint assignment:

    • 基础Basics

      • 订阅:在蓝图示例副本所保存到的管理组中选择一个或多个订阅。Subscriptions: Select one or more of the subscriptions that are in the management group you saved your copy of the blueprint sample to. 如果选择多个订阅,将使用输入的参数为每个订阅创建一个分配。If you select more than one subscription, an assignment will be created for each using the parameters entered.
      • 分配名称:系统会根据蓝图定义的名称预先填充该名称。Assignment name: The name is pre-populated for you based on the name of the blueprint definition.
      • 位置:选择要在其中创建托管标识的区域。Location: Select a region for the managed identity to be created in. Azure 蓝图使用此托管标识在分配的蓝图中部署所有项目。Azure Blueprint uses this managed identity to deploy all artifacts in the assigned blueprint. 若要了解详细信息,请参阅 Azure 资源的托管标识To learn more, see managed identities for Azure resources. 本教程选择了“美国东部 2”。 For this tutorial, select East US 2.
      • 蓝图定义版本:选择示例蓝图定义副本的“已发布”版本 1.0Blueprint definition version: Pick the Published version 1.0 of your copy of the sample blueprint definition.
    • 锁分配Lock Assignment

      选择“只读”蓝图锁定模式。 Select the Read Only blueprint lock mode. 有关更多信息,请参阅蓝图资源锁定For more information, see blueprints resource locking.

    • 托管标识Managed Identity

      保留默认的“系统分配”选项。 Leave the default System assigned option. 有关详细信息,请参阅托管标识For more information, see managed identities.

    • 项目参数Artifact parameters

      在本部分定义的参数将应用到定义了这些参数的项目。The parameters defined in this section apply to the artifact under which it's defined. 这些参数属于动态参数 ,因为它们是在分配蓝图期间定义的。These parameters are dynamic parameters since they're defined during the assignment of the blueprint. 对于每个项目,请将参数值设置为“值”列中定义的值。 For each artifact, set the parameter value to what is defined in the Value column. 对于 {Your ID},请选择你的 Azure 用户帐户。For {Your ID}, select your Azure user account.

      项目名称Artifact name 项目类型Artifact type 参数名称Parameter name Value 说明Description
      ProdRG 资源组ProdRG resource group 资源组Resource group 名称Name ProductionRGProductionRG 定义第一个资源组的名称。Defines the name of the first resource group.
      ProdRG 资源组ProdRG resource group 资源组Resource group 位置Location 美国西部 2West US 2 设置第一个资源组的位置。Sets the location of the first resource group.
      参与者Contributor 角色分配Role assignment 用户或组User or Group {你的 ID}{Your ID} 定义要将“参与者”角色授予第一个资源组中的哪个用户或组。 Defines which user or group to grant the Contributor role assignment within the first resource group.
      PreProdRG 资源组PreProdRG resource group 资源组Resource group 名称Name PreProductionRGPreProductionRG 定义第二个资源组的名称。Defines the name of the second resource group.
      PreProdRG 资源组PreProdRG resource group 资源组Resource group 位置Location 美国西部West US 设置第二个资源组的位置。Sets the location of the second resource group.
      “所有者”Owner 角色分配Role assignment 用户或组User or Group {你的 ID}{Your ID} 定义要将“所有者”角色授予第二个资源组中的哪个用户或组。 Defines which user or group to grant the Owner role assignment within the second resource group.
      读取者Readers 角色分配Role assignment 用户或组User or Group {你的 ID}{Your ID} 定义要将“读取者”角色授予第二个资源组中的哪个用户或组。 Defines which user or group to grant the Readers role assignment within the second resource group.
  5. 输入所有参数后,选择页面底部的“分配”。 Once all parameters have been entered, select Assign at the bottom of the page.

此步骤部署定义的资源,并配置选定的 锁分配This step deploys the defined resources and configures the selected Lock Assignment. 应用蓝图锁最长可能需要花费 30 分钟。Blueprint locks can take up to 30 minutes to apply.

“分配蓝图定义成功”门户通知出现后,转到下一步骤。 Once the Assigning blueprint definition succeeded portal notification appears, move to the next step.

检查分配部署的资源Inspect resources deployed by the assignment

蓝图分配会创建并跟踪蓝图定义中定义的项目。The blueprint assignment creates and tracks the artifacts defined in the blueprint definition. 可以在蓝图分配页中通过直接查看资源来检查资源的状态。We can see the status of the resources from the blueprint assignment page and by looking at the resources directly.

  1. 在左侧窗格中,选择“所有服务” 。Select All services in the left pane. 搜索并选择“蓝图”。Search for and select Blueprints.

  2. 在左侧选择“分配的蓝图”页。 Select the Assigned blueprints page on the left. 使用筛选器找到 Assignment-two-rgs-with-role-assignments 蓝图分配,并将其选中。Use the filters to find the Assignment-two-rgs-with-role-assignments blueprint assignment and then select it.

    在此页中,可以看到分配成功消息、创建的资源列表及其蓝图锁定状态。From this page, we can see the assignment succeeded and the list of created resources along with their blueprint lock state. 如果更新了分配,“分配操作”下拉列表会显示有关每个定义版本的部署的详细信息。 If the assignment is updated, the Assignment operation drop-down shows details about the deployment of each definition version. 可以选择列出的每个已创建资源,打开该资源的属性页。Each listed resource that was created can be selected and opens that resources property page.

  3. 选择“ProductionRG”资源组。 Select the ProductionRG resource group.

    可以看到,该资源组的名称是 ProductionRG,而不是项目显示名称 ProdRGWe see that the name of the resource group is ProductionRG and not the artifact display name ProdRG. 此名称与蓝图分配期间设置的值相匹配。This name matches the value set during the blueprint assignment.

  4. 在左侧选择“访问控制(IAM)”页,然后选择“角色分配”选项卡。 Select the Access control (IAM) page on the left and then the Role assignments tab.

    在此处可以看到,为你的帐户授予了“此资源”范围的“参与者”角色。 Here we see that your account has been granted the Contributor role on the scope of This resource. Assignment-two-rgs-with-role-assignments 蓝图分配具有“所有者”角色,因为资源组是使用该分配创建的。 The Assignment-two-rgs-with-role-assignments blueprint assignment has the Owner role as it was used to create the resource group. 这些权限还用于管理配置有蓝图锁的资源。These permissions are also used to manage resources with configured blueprint locks.

  5. 在 Azure 门户痕迹导航中,选择“Assignment-two-rgs-with-role-assignments”返回前一页面,然后选择“PreProductionRG”资源组。 From the Azure portal breadcrumb, select Assignment-two-rgs-with-role-assignments to go back one page, then select the PreProductionRG resource group.

  6. 在左侧选择“访问控制(IAM)”页,然后选择“角色分配”选项卡。 Select the Access control (IAM) page on the left and then the Role assignments tab.

    在此处可以看到,为你的帐户授予了“此资源”范围的“所有者”和“读取者”角色。 Here we see that your account has been granted both the Owner and Reader roles, both on the scope of This resource. 与第一个资源组一样,该蓝图分配也具有“所有者”角色。 The blueprint assignment also has the Owner role like the first resource group.

  7. 选择“拒绝分配”选项卡。 Select the Deny assignments tab.

    该蓝图分配在部署的资源组中创建了一个拒绝分配,以强制实施“只读”蓝图锁定模式。The blueprint assignment created a deny assignment on the deployed resource group to enforce the Read Only blueprint lock mode. 该拒绝分配会阻止“角色分配”选项卡中具有相应权限的某人执行特定的操作。The deny assignment prevents someone with appropriate rights on the Role assignments tab from taking specific actions. 拒绝分配会影响所有主体。 The deny assignment affects All principals.

  8. 选择该拒绝分配,然后在左侧选择“拒绝的权限”页。 Select the deny assignment, then select the Denied Permissions page on the left.

    该拒绝分配正在阻止使用 * 和 Action 配置的所有操作,但允许通过 NotActions 排除 */read,以此进行读取访问 。The deny assignment is preventing all operations with the ***_ and _* Action* configuration, but allows read access by excluding */read via NotActions.

  9. 在 Azure 门户痕迹导航中,选择“PreProductionRG - 访问控制(IAM)”。 From the Azure portal breadcrumb, select PreProductionRG - Access control (IAM). 在左侧选择“概述”页,然后选择“删除资源组”按钮。 Then select the Overview page on the left and then the Delete resource group button. 输入名称 PreProductionRG 以确认删除,然后选择窗格底部的“删除”。 Enter the name PreProductionRG to confirm the delete and select Delete at the bottom of the pane.

    此时会显示门户通知“删除资源组 PreProductionRG 失败”。 The portal notification Delete resource group PreProductionRG failed is displayed. 错误中指出,尽管你的帐户有权删除资源组,但蓝图分配拒绝了访问。The error states that while your account has permission to delete the resource group, access is denied by the blueprint assignment. 回顾前文,我们在蓝图分配期间选择了“只读”蓝图锁定模式。 Remember that we selected the Read Only blueprint lock mode during blueprint assignment. 蓝图锁会阻止具有权限的帐户(甚至包括“所有者”)删除资源。The blueprint lock prevents an account with permission, even Owner, from deleting the resource. 有关更多信息,请参阅蓝图资源锁定For more information, see blueprints resource locking.

这些步骤演示了我们的资源是根据定义创建的,蓝图锁会阻止意外的删除,甚至可以阻止具有权限的帐户执行删除。These steps show that our resources were created as defined and the blueprint locks prevented unwanted deletion, even from an account with permission.

取消分配蓝图Unassign the blueprint

最后一步是删除蓝图分配及其部署的资源。The last step is to remove the assignment of the blueprint and the resources that it deployed. 删除分配不会删除已部署的项目。Removing the assignment doesn't remove the deployed artifacts.

  1. 在左侧窗格中,选择“所有服务” 。Select All services in the left pane. 搜索并选择“蓝图”。Search for and select Blueprints.

  2. 在左侧选择“分配的蓝图”页。 Select the Assigned blueprints page on the left. 使用筛选器找到 Assignment-two-rgs-with-role-assignments 蓝图分配,并将其选中。Use the filters to find the Assignment-two-rgs-with-role-assignments blueprint assignment and then select it.

  3. 选择页面顶部的“取消分配蓝图”按钮。 Select the Unassign blueprint button at the top of the page. 阅读确认对话框中的警告,然后选择“确定”。 Read the warning in the confirmation dialog, then select OK.

    删除蓝图分配时,蓝图锁也会一并删除。With the blueprint assignment removed, the blueprint locks are also removed. 具有权限的帐户现在又可以删除创建的资源。The created resources can once again be deleted by an account with permissions.

  4. 在 Azure 菜单中选择“资源组”,然后选择“ProductionRG”。 Select Resource groups from the Azure menu, then select ProductionRG.

  5. 在左侧选择“访问控制(IAM)”页,然后选择“角色分配”选项卡。 Select the Access control (IAM) page on the left and then the Role assignments tab.

每个资源组的安全性仍具有已部署的角色分配,但蓝图分配不再具有“所有者”访问权限。The security for each resource group still has the deployed role assignments, but the blueprint assignment no longer has Owner access.

“删除蓝图分配成功”门户通知出现后,转到下一步骤。 Once the Removing blueprint assignment succeeded portal notification appears, move to the next step.

清理资源Clean up resources

完成本教程后,请删除以下资源:When finished with this tutorial, delete the following resources:

  • 资源组 ProductionRGResource group ProductionRG
  • 资源组 PreProductionRGResource group PreProductionRG
  • 蓝图定义 two-rgs-with-role-assignmentsBlueprint definition two-rgs-with-role-assignments

后续步骤Next steps

在本教程中,你已了解如何通过示例定义创建新的蓝图。In this tutorial, you've learned how to create a new blueprint from a sample definition. 若要详细了解 Azure 蓝图,请继续学习蓝图生命周期文章。To learn more about Azure Blueprints, continue to the blueprint lifecycle article.