Allow users to restrict an az login session to one resource group or resource

未关闭
  • 哪里不对？
#34,162 4 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@isra-fel 已经在做这个了。

开始于 2026年10月3日。

评估

这个 Issue 还没有评估数据。

描述

Account act-codegen-extensibility-squad act-identity-squad ARM Auto-Assign Azure CLI Team customer-reported feature-request

Related command

az login

Suggested syntax below is illustrative, not an existing option.

Is your feature request related to a problem? Please describe.

My Azure user has legitimate access to several resource groups, including production systems. When working on development, I would like that specific login session to only have access to the development group.

This would be useful for ordinary terminal work, scripts, automation and agents. My account needing production access does not mean every work session I have needs it.

Read-only mode does not solve this. I need to write within the selected group, AND prevent reads of sensitive resources outside it.

Describe the solution you'd like

Could az login let a user voluntarily narrow their existing permissions for one session, without administrator collaboration or changes to their normal role assignments?

For example:

az login --restrict-to \
  "/subscriptions/<subscription-id>/resourceGroups/development"

Then ordinary commands would behave like this:

# Allowed if my user already has the required permissions.
az storage blob upload \
  --account-name devstorage \
  --container-name test \
  --name example.txt \
  --file ./example.txt \
  --auth-mode login

# Blocked because production is outside this session's scope.
az group show --name production

# Also blocked.
az group delete --name production

Resource-group scoping would already take us pretty far. Ideally, the same approach could allow selecting an individual resource within a group.

The restriction should be tied to the session's credentials and enforced by Azure. Changing command arguments, configuration or using the token directly should not bypass it. It should only reduce existing access, never grant additional permissions.

Describe alternatives you've considered

  • A separate identity with scoped RBAC. That can work, but requires provisioning another identity and permission assignments rather than simply narrowing my current login.
  • Storage SAS tokens. Useful for specific storage tasks, but not a general solution for Azure resource management.
  • Default resource groups, shell wrappers and instructions to agents. These help avoid mistakes, but do not restrict what the credentials can access.

Additional context

This is a general CLI safety feature, not specifically an agent identity or MCP request. Agents are one use case where limiting the consequences of mistakes matters.

The restricted workflow should not silently fall back to unrestricted credentials. Other broad credentials accessible on the machine would still need to be kept away from the script or agent.

I am not sure whether Azure's existing authorization APIs support this. Could someone familiar with CLI authentication clarify whether it is feasible today, or which underlying Azure capability would be needed?

Related: #32974, global read-only mode. This request differs because it allows writes within the selected scope while also blocking sensitive reads outside it.

主要语言
Python
星标
4.7k
派生
3.5k
平均合并
4 天 14 小时
30 天内合并 PR
92

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Azure/azure-cli 的其他 Issue

查看 Azure/azure-cli 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。