azure - 将文件共享添加到具有专用终结点的存储帐户时出错

Question

我创建了一个具有专用终结点的存储帐户。我正在尝试在存储帐户上创建文件共享，但是当我尝试使用 azurerm_storage_share 创建文件共享时，我收到以下错误，我不确定为什么，请有人帮忙吗？

错误

|   Error: checking for existence of existing Storage Share "profiles" (Account "stfslogixuks01" / Resource Group "rg-avd-shared-uks-001"): shares.Client#GetProperties: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailure" Message="This request is not authorized to perform this operation.\nRequestId:e010828e-b01a-003c-7dbd-c9065f000000\nTime:2022-09-16T11:12:03.0199276Z"
│
│   with module.storage.azurerm_storage_share.st_shares["profiles"],
│   on modules\storage_accounts\main.tf line 22, in resource "azurerm_storage_share" "st_shares":
│   22: resource "azurerm_storage_share" "st_shares" {

创建存储帐户下面的代码用于创建存储帐户。

resource "azurerm_storage_account" "st" {
    name = var.st.name
    resource_group_name = var.rg_shared_name
    location = var.rg_shared_location
    account_tier = var.st.tier
    account_replication_type = var.st.replication
    public_network_access_enabled = false
    allow_nested_items_to_be_public = false
    azure_files_authentication {
      directory_type = "AD"
      active_directory {
        storage_sid = "storage_sid"
        domain_name = "domain_name"
        domain_sid = "domain_sid"
        domain_guid = "domain_guid"
        forest_name = "forest_name"
        netbios_domain_name = "netbios_domain_name"
      }
    }
}

文件共享创建下面的代码用于创建文件共享。

resource "azurerm_storage_share" "st_shares" {
  depends_on = [azurerm_storage_account.st]
  for_each = var.st_shares
  name = each.value.name
  storage_account_name = azurerm_storage_account.st.name
  quota = "5120"
}

Answer 1

我们正在使用您在下面看到的解决方法。它获取您的 IP 地址并将其列入存储帐户的防火墙白名单。完整模块可以找到 here .

# FIXME: https://github.com/hashicorp/terraform-provider-azurerm/issues/6659
data "http" "ip" {
  url = "https://ifconfig.me"
}

resource "azurerm_storage_account_network_rules" "storage_account_network_rules" {
  storage_account_id         = azurerm_storage_account.storage_account.id
  default_action             = var.network_default_action
  ip_rules                   = concat(var.network_ip_rules, [data.http.ip.body])
  virtual_network_subnet_ids = var.network_subnet_ids
  bypass                     = ["Logging", "Metrics", "AzureServices"]
}