azure - 如何向 Terraform 中的 Azure Devops 项目授予 "Storage Blob Data Contributor"权限？

Question

看来我的问题与此相关post但既然没有答案，我会再问一次。

我有一个 Azure Devops 项目，用于通过管道将静态内容部署到存储帐户内的容器中。我最近决定使用 Terraform 以及我的代码来部署我的基础设施，但我遇到了一个问题。我成功地在管道内使用 Terraform 创建了所有基础设施(角色分配除外)。

我基本上需要通过 Azure 添加一个新的角色分配到我的存储帐户:

1. 转到我的存储帐户
2. 转至访问控制 (IAM)
3. 添加新的角色分配
4. 选择存储 Blob 数据贡献者
5. 点击选择成员
6. 选择我的Azure DevOps 项目
7. 审核 + 分配

根据我对Terraform documentation的理解我应该做这样的事情:

resource "azurerm_resource_group" "resource_group" {
  name     = var.resource_group_name
  location = var.location
}

resource "azurerm_storage_account" "storage_account" {
  name                     = var.storage_account_name
  resource_group_name      = azurerm_resource_group.resource_group.name
  location                 = azurerm_resource_group.resource_group.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_role_assignment" "role_assignment" {
  scope                = azurerm_storage_account.storage_account.id
  role_definition_id = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe" # Which is the Storage Blob Data Contributor role if I'm not mistaken. 
  principal_id         = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" # Which should be the Application ID ?
}

除了它不起作用之外，当我尝试在没有 Azure Pipeline 的情况下在本地运行它来检查它是否有效时，该进程卡在“仍在创建...”状态超过 10 分钟，这似乎很奇怪，因为当您手动执行此操作时，最多只需要几秒钟。我没有任何错误，只是最终取消了命令。

我在这里错过了什么/做错了什么？

Answer 1

我已经找到问题所在了。对于principal_id，您需要输入服务主体的Object_ID，而不是您的Application_ID。你最终会得到类似的结果:

ma​​in.tf

...

locals {
  sub = "/subscription"
  permission_storage_blob_data_contributor = "providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe"
}

data "azurerm_subscription" "primary" { }

resource "azurerm_resource_group" "resource_group" {
  name     = var.resource_group_name
  location = var.location
}

resource "azurerm_storage_account" "storage_account" {
  name                     = var.storage_account_name
  resource_group_name      = azurerm_resource_group.resource_group.name
  location                 = azurerm_resource_group.resource_group.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_role_assignment" "role_assignment" {
  scope               = azurerm_storage_account.storage_account.id
  role_definition_id  = join("/", [local.sub, data.azurerm_subscription.primary.subscription_id, local.permission_storage_blob_data_contributor])
  principal_id        = var.devops_project_object_id
}

...

变量.tf

...

variable "location" {
    type = string
    description = "Location for the deployment"
    default = "West Europe"
}

variable "resource_group_name" {
    type = string
    description = "Resource Group Name"
}

variable "storage_account_name" {
    type = string
    description = "Storage Account Name"
}

# yyyyyyyy-yyyy-yyyy-yyyyyyyyyyyy format
variable "devops_project_object_id" {
    type = string
    description = "Object ID (principal_id) for the Devops Project linked to the Azure Subscription in the Azure Active Directory."
}

...