azure - 应该使用environment() bicep函数来生成url而不是硬编码它们

Question

我有一个应用程序防火墙规则，需要重写一些硬编码 URL 的 targetFqdn，因此我使用环境 bicep 函数。

网址是:

 targetFqdns: [
     '*.blob.core.windows.net'
     'login.microsoftonline.com'
     'management.core.windows.net'
     'management.azure.com'
     'graph.windows.net'
 ]

但是当我尝试使用 enviroment() 然后部署时，请求无效

targetFqdns: [ 
    '*.blob.${environment().suffixes.storage}' // '*.blob.core.windows.net'
    '${environment().authentication.loginEndpoint}' // 'login.microsoftonline.com'
    '${environment().authentication.audiences}' // 'management.core.windows.net'
    '${environment().resourceManager}' // 'management.azure.com'
    '${environment().graphAudience}' // 'graph.windows.net'
]

enviroment() 二头肌函数文档: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-functions-deployment#environment

部署错误消息:

{
    "status": "Failed",
    "error": {
        "code": "DeploymentFailed",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
        "details": [
            {
                "code": "BadRequest",
                "message": "{\r\n  \"Message\": \"The request is invalid.\",\r\n  \"ModelState\": {\r\n    \"resource\": [\r\n      \"{\\\"Status\\\":\\\"Failed\\\",\\\"Error\\\":{\\\"Code\\\":\\\"FirewallPolicyApplicationRuleInvalidTargetFqdn\\\",\\\"Message\\\":\\\"Firewall Policy Application Rule dev-firewall-rule has invalid target fqdn https://login.microsoftonline.com/\\\",\\\"Target\\\":null}}\"\r\n    ]\r\n  }\r\n}"
            }
        ]
    }
}

Answer 1

查看您引用的文档，一些environment()属性是URI而不仅仅是域:

{
  "graphAudience": "https://graph.windows.net/",
  "resourceManager": "https://management.azure.com/",
  "authentication": {
    "loginEndpoint": "https://login.windows.net/",
    "audiences": [
      "https://management.core.windows.net/",
      "https://management.azure.com/"
    ]
  }
}

您需要从 URI 中删除 scheme 和 //。此外，audiences 属性是一个字符串数组:

// Extract domains from audience
var authAudienceDomains = [for aud in environment().authentication.audiences: replace(replace(aud, 'https://', ''), '/', '')]

// Concactenate fqdns
output targetFqdns array = concat(
  [
    // *.blob.core.windows.net
    '*.blob.${environment().suffixes.storage}'
    // login.windows.net
    replace(replace(environment().authentication.loginEndpoint, 'https://', ''), '/', '')
    // graph.windows.net
    replace(replace(environment().graphAudience, 'https://', ''), '/', '')
  ],
  // management.core.windows.net and management.azure.com
  authAudienceDomains
)