azure - 从同一租户中的另一个订阅访问本地数据网关资源

Question

我正在尝试在 ARM 模板中创建一个包含详细信息的 SQL 连接器，并使用 ARM 模板部署通过 DevOps 进行部署。

我当前的订阅想要访问我们的通用订阅，以便我可以将凭据添加到与本地 SQL Server 的本地数据网关连接。

{
        "type": "Microsoft.Web/connections",
        "apiVersion": "2016-06-01",
        "name": "[parameters('connections_sql_winauth_name')]",
        "location": "northeurope",
        "kind": "V1",
        "properties": {
            "displayName": "winauth-cn",
            "customParameterValues": {},  
            "parameterValues": {
                "server": "[parameters('bi_server_name')]",
                "database": "{dB}",
                "authType": "Windows Authentication",
                "username": "{username}",
                "password": "{password}",
                "gateway": {
                    "id": "/subscriptions/{different subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Web/connectionGateways/{data gateway-resource-name}"
                }
            },
            "api": {
                "id": "[concat('/subscriptions/',subscription().subscriptionId,'/providers/Microsoft.Web/locations/northeurope/managedApis/sql')]"
            }
        }
    },

当我尝试运行部署管道时，我收到以下错误:

2021-01-26T16:49:37.7344633Z ##[error]LinkedAuthorizationFailed: The client 'x' with object id 'y' has permission to perform action 'Microsoft.Web/connections/write' on scope '/subscriptions/{current subscription}/resourcegroups/{mainResourceGroup}/providers/Microsoft.Web/connections/sql-02'; however, it does not have permission to perform action 'Microsoft.Web/connectionGateways/associate/action' on the linked scope(s) '/subscriptions/{differentSubscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Web/connectionGateways/{data gateway-resource-name}' or the linked scope(s) are invalid.

有人知道我如何成功部署吗？我知道这在门户中是可能的，但在门户中，我很难在我创建的重命名的 API 连接上应用凭据。

Answer 1

根据 doc，错误代码为 LinkedAuthorizationFailed :我们需要检查您的帐户是否与您要部署到的资源组属于同一租户。

详细的错误消息是:它没有权限在链接的范围上执行操作“Microsoft.Web/connectionGateways/associate/action”。我们需要检查角色是否有足够的权限，引用这个doc了解更多详情。