通过Azure资源管理器（ARM）模板创建SQL Server

时间：2018-08-20 10:55:38

标签： sql-server azure azure-sql-database azure-resource-manager azure-cli

我正在尝试创建SQL Server的新Azure实例，然后在其中创建一些新数据库。

我从Azure门户知道某些管理员用户可能是：

  • 一个 SA 用户（我认为这表示“ Server Admin”，它看起来像某种管理SQL Server实例的旧方法，但同时又非常“基础”，并且证明了工作）
    • Active Directory用户（在此处不确定Azure术语，但是看起来这可能是整个Azure平台的“广泛用户”，例如我自己的Azure Portal登录用户，这不是特定于数据库的）世界）。

我想创建一个具有SA用户的SQL Server来管理服务器。 在Azure门户中，我找不到为SQL Server实例的SA用户生成ARM模板的方法。

我正在从10000行的ARM模板复制粘贴，以获取很长的SQL服务器和数据库列表，但是我无法隔离基本步骤，以期获得一个希望简洁且简短的ARM模板。

这是我正在尝试在Azure上部署的ARM模板：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
      "location": {
          "type": "string",
          "defaultValue": "westeurope"
        },
      "foo_sql_server_name": {
          "defaultValue": "foo-sql-server",
          "type": "String"
      }
    },
    "resources": [
      {
          "type": "Microsoft.Sql/servers",
          "kind": "v12.0",
          "name": "[parameters('foo_sql_server_name')]",
          "apiVersion": "2015-05-01-preview",
          "location": "[parameters('location')]",
          "scale": null,
          "properties": {
              "administratorLogin": "<MY_SA_USER_THAT_I_CAN_NOT_CREATE>",
              "version": "12.0"
          },
          "dependsOn": []
      }
    ]
}

使用以下命令运行上述内容时

az group deployment create \
  --name "deployDBs" \
  --resource-group "MyCustomResourceGroup" \
  --template-file ./templates/db.json # --verbose --debug

然后我收到以下错误消息：

Deployment failed. Correlation ID: <A_CUSTOM_GUID>. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "InvalidParameterValue",
        "message": "Invalid value given for parameter Password. Specify a valid parameter value."
      }
    ]
  }
}

在删除JSON字段administratorLogin时（因为希望我可以以某种方式在尚未确定的其他地方创建SA用户），然后收到以下错误消息：

Deployment failed. Correlation ID: <ANOTHER_CUSTOM_GUID>. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "InvalidParameterValue",
        "message": "Invalid value given for parameter Login. Specify a valid parameter value."
      }
    ]
  }
}

我无法从10000行自动生成的ARM模板中找到SA用户（服务器管理员）的“用户名密码”对的定义。

在部署SQL Server的新实例时，如何为SQL Server创建/注入SA用户？

3 个答案:

答案 0 :(得分：4)

您在本地SQL Server实例上使用的sa登录在Azure SQL上称为Admin登录。您可以提供管理员登录名及其密码作为参数，如以下示例模板所示：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "yourservernameName": {
      "type": "string",
      "defaultValue": "yourservername2"
    },
    "yourservernameAdminLogin": {
      "type": "string",
      "defaultValue": "VeryWiseAdmin",
      "minLength": 1
    },
    "yourservernameAdminLoginPassword": {
      "type": "securestring",
      "defaultValue": "ReplaceWithTheMostSecurePasswordThatEverExisted&NeverShareLikeThisWithAnyone!"
    },
    "dbnameName": {
      "type": "string",
      "defaultValue": "dbname",
      "minLength": 1
    },
    "dbnameCollation": {
      "type": "string",
      "minLength": 1,
      "defaultValue": "SQL_Latin1_General_CP1_CI_AS"
    },
    "dbnameEdition": {
      "type": "string",
      "defaultValue": "Basic"
    },
    "dbnameRequestedServiceObjectiveName": {
      "type": "string",
      "defaultValue": "Basic"
    }
  },
  "variables": {
  },
  "resources": [
    {
      "name": "[parameters('yourservernameName')]",
      "type": "Microsoft.Sql/servers",
      "location": "West Europe",
      "apiVersion": "2014-04-01-preview",
      "dependsOn": [],
      "tags": {
        "displayName": "yourservername"
      },
      "properties": {
        "administratorLogin": "[parameters('yourservernameAdminLogin')]",
        "administratorLoginPassword": "[parameters('yourservernameAdminLoginPassword')]",
        "version": "12.0"
      },
      "resources": [
        {
          "name": "[concat(parameters('yourservernameName'),'/AllowAllWindowsAzureIps')]",
          "type": "Microsoft.Sql/servers/firewallRules",
          "location": "[resourceGroup().location]",
          "apiVersion": "2014-04-01-preview",
          "dependsOn": [
            "[resourceId('Microsoft.Sql/servers', parameters('yourservernameName'))]"
          ],
          "properties": {
            "startIpAddress": "0.0.0.0",
            "endIpAddress": "0.0.0.0"
          }
        },
        {
          "name": "[concat(parameters('yourservernameName'),'/',parameters('dbnameName'))]",
          "type": "Microsoft.Sql/servers/databases",
          "location": "West Europe",
          "apiVersion": "2014-04-01-preview",
          "dependsOn": [
            "[resourceId('Microsoft.Sql/servers', parameters('yourservernameName'))]"
          ],
          "tags": {
            "displayName": "dbname"
          },
          "properties": {
            "collation": "[parameters('dbnameCollation')]",
            "edition": "[parameters('dbnameEdition')]",
            "maxSizeBytes": "1073741824",
            "requestedServiceObjectiveName": "[parameters('dbnameRequestedServiceObjectiveName')]"
          }
        }
      ]
    }
  ],
  "outputs": {
    "SomeString": {
      "type": "string",
      "value": "What ever you want to put here"
    },
    "ServerNameParam": {
      "type": "string",
      "value": "[parameters('yourservernameName')]"
    },
    "ServerResourceID": {
      "type": "string",
      "value": "[resourceId('Microsoft.Sql/servers', parameters('yourservernameName'))]"
    },
    "ServerObject": {
      "type": "object",
      "value": "[reference(parameters('yourservernameName'))]"
    },
    "SqlServerURL": {
      "type": "string",
      "value": "[reference(parameters('yourservernameName')).fullyQualifiedDomainName]"
    },
    "DbResourceID": {
      "type": "string",
      "value": "[resourceId('Microsoft.Sql/servers/databases', parameters('yourservernameName'), parameters('dbnameName'))]"
    },
    "DbObject": {
      "type": "object",
      "value": "[reference(parameters('dbnameName'))]"
    },
    "DbAdoConnString": {
      "type": "string",
      "value": "[concat('Server=tcp:',reference(parameters('yourservernameName')).fullyQualifiedDomainName,',1433;Initial Catalog=',parameters('dbnameName'),';Persist Security Info=False;User ID=',reference(parameters('yourservernameName')).administratorLogin,';Password=',reference(parameters('yourservernameName')).administratorLoginPassword,';MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;')]"
    }
  }

}

答案 1 :(得分：2)

工作示例：

SA

请注意， "name" => array:1 [▼ 1 => array:2 [▼ 1 => "Jake" // name of the participant being registered in the registration_type_id 1 2 => "John" // name of the participant being registered in the registration_type_id 1 ] ] "surname" => array:1 [▼ 1 => array:2 [▼ 1 => "W" // surname off 1st participant being registered in the registration_type_id 1 2 => "K" // surname off 2nd participant being registered in the registration_type_id 1 ] ] "answer" => array:1 [▼ 1 => array:2 [▼ 1 => array:2 [▼ // answers of the 1st participant being registered in the registration_type_id 1 1 => "answer1p1" 2 => "answer2p1" ] 2 => array:2 [▼ // answers of 2nd participant being registered in the registration_type_id 1 1 => "answer1p2" 2 => "answer2p2" ] ] ] 可能不被允许，因为用户名和密码具有复杂性要求

答案 2 :(得分：1)

我们希望为每个资源组创建一个临时的唯一密码，并且不必担心模板或参数文件中的密码，因为这些密码已签入git。这样解决：

h1 {margin:0} .contentWrap {border:1px solid red; padding:5px} .close {color:red;text-align:right}：

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<div id="showlists"></div>

“为了确保我们符合Azure SQL数据库策略，”您的密码必须包含以下三个类别的字符-英文大写字母，英文小写字母，数字（0-9）和非字母数字字符（！，$，＃，％等）”，我们在唯一字符串的前后为每个类别插入一个字符。”

来源：

https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-string#uniquestring

https://vivien-chevallier.com/Articles/automatically-generate-a-password-for-an-azure-sql-database-with-arm-template

警告：

如果添加到您的template.json：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vulnerabilityAssessments_Default_storageContainerPath": {
      "type": "SecureString"
    },
    "servers_dev_name": {
      "defaultValue": "dev-app",
      "type": "String"
    }
  },
  "variables": {
    "servers_dev_password": "[concat('P', uniqueString(resourceGroup().id, '224F5A8B-51DB-46A3-A7C8-59B0DD584A41'), 'x', '!')]",
  },
  "resources": [
    {
      "type": "Microsoft.Sql/servers",
      "apiVersion": "2019-06-01-preview",
      "name": "[parameters('servers_dev_name')]",
      "location": "northeurope",
      "kind": "v12.0",
      "properties": {
        "administratorLogin": "OurSaName",
        "administratorLoginPassword": "[variables('servers_dev_password')]",
        "version": "12.0",
        "publicNetworkAccess": "Enabled"
      }
    },

并将参数添加到parameters.json，实际密码将为："servers_dev_password": { "value": "[uniqueString(resourceGroup().id)]" } 。

template.json
相关问题
最新问题