Azure ARM 在模板部署期间抛出错误的存储连接字符串请求

Question

我正在创建一个 azure 存储帐户、 key 保管库，并将存储帐户访问 key 作为 key 添加到 key 保管库。我没有发现 ARM 代码有任何问题，但当我在 Azure 中部署此代码时，我收到了错误的连接 key 请求。

 {
            "condition": "[equals(parameters('storageAccountOption'), 'new')]",
            "name": "[variables('storageaccountuniqueName')]",
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2019-06-01",
            "tags": "[parameters('tagValues')]",
            "location": "[parameters('location')]",
            "kind": "StorageV2",
            "sku": {
                "name": "Standard_LRS",
                "tier": "Standard"
            }            
        },
        {
            "name": "[variables('kvname')]",
            "type": "Microsoft.KeyVault/vaults",
            "apiVersion": "2019-09-01",
            "location": "[resourceGroup().location]",
            "tags": "[parameters('tagValues')]",
            "properties": {
                "enabledForDeployment": false,
                "enabledForTemplateDeployment": true,
                "enabledForDiskEncryption": false,
                "tenantId": "[variables('tenantId')]",
                "accessPolicies": [
                    {
                        "tenantId": "[variables('tenantId')]",
                        "objectId": "[parameters('kv_owner_id')]",
                        "permissions": {
                            "secrets": [
                                "all"
                            ]
                        }  
                    },
                    {
                        "tenantId": "[variables('tenantId')]",
                        "objectId": "[reference(resourceId('Microsoft.DataFactory/factories', variables('adfname')), '2018-06-01', 'full').identity.principalId]",
                        "permissions": {
                            "keys": [],
                            "secrets": [
                                "list",
                                "get"                                
                            ]
                        }
                    }                    
                ],
                "sku": {
                    "name": "standard",
                    "family": "A"
                }
            }            
        },
        {
            "name": "[concat(variables('kvname'), '/', variables('kv-stg-secretname'))]",
            "type": "Microsoft.KeyVault/vaults/secrets",
            "apiVersion": "2019-09-01",
            "location": "[resourceGroup().location]",
            "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('storageaccountuniqueName'))]",
                "[resourceId('Microsoft.KeyVault/vaults', variables('kvname'))]"
            ],
            "properties": {
                "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageaccountuniqueName'), ';AccountKey=', listKeys(variables('storageaccountid'), '2019-06-01').keys[0].value,';EndpointSuffix=core.windows.net')]"
            }
        }

我已设置 keyvault key 的依赖项，以确保仅在部署存储帐户和 Key Vault 后才完成此操作。这是来自 Azure 的部署错误。我使用服务主体和 Azure Cli 来部署它，因此 kv_owner_id 是从 cli 传递的，作为服务主体客户端 ID。

{
  "code": "DeploymentFailed",
  "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
  "details": [
    {
      "code": "BadRequest",
      "message": ""
    }
  ]
}

以下是从门户中看到的部署操作的概述。除了 conn 字符串 secret 之外，所有内容均已成功创建。

Answer 1

如何定义 storageaccountid 变量？您可以在 listKeys 中使用标准 resourceId() 引用:

"properties": {
    "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageaccountuniqueName'), ';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageaccountuniqueName')), '2019-06-01').keys[0].value,';EndpointSuffix=core.windows.net')]"
}