我已经通过ARM模板创建了Azure SQL服务器。要启用漏洞评估,我需要启用高级数据安全性。 我在SQL Server资源的资源支架内的ARM模板中使用以下代码来启用此功能。
{
"name": "vulnerabilityAssessments",
"type": "vulnerabilityAssessments",
"apiVersion": "2018-06-01-preview",
"dependsOn": [
"[concat('Microsoft.Sql/servers/', parameters('sqlServerName'))]"
],
"properties": {
"storageContainerPath": "[concat('https://', parameters('storageAccountName'), '.blob.core.windows.net/vulnerability-assessment/')]",
"storageAccountAccessKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"emails": "[parameters('emailaddresses')]"
}
}
},
如您所见,我将存储帐户设置为漏洞评估,但是在部署此帐户时,出现以下错误:
VulnerabilityAssessmentADSIsDisabled", "message": "Advanced Data Security should be enabled in order to use Vulnerability Assessment."
当我查看我的SQL Server的高级数据安全性刀片时,我看到已设置以下内容:
如果我手动设置存储帐户。漏洞评估已启用。... 我试图更改数据库级别的漏洞评估括号,并尝试调试属性中的存储帐户引用,但似乎看不到我做错了什么或忘记了什么? 已经有人尝试这样做了吗?
PS:就像您在图像中看到的那样,定期重复扫描已关闭,而我已在漏洞评估的重复扫描阵列中启用了此功能。
答案 0 :(得分:3)
您遇到的问题是由于部署具有漏洞评估功能的ARM模板而没有首先启用高级数据安全性引起的。
您将必须在ARM模板中部署Advanced Data Security,并在Vulnerability Assessment块中添加一个依赖项,因此只有在部署Advanced Data Security之后才能部署它。
例如:
{
"apiVersion": "2017-03-01-preview",
"type": "Microsoft.Sql/servers/securityAlertPolicies",
"name": "[concat(parameters('serverName'), '/Default')]",
"properties": {
"state": "Enabled",
"disabledAlerts": [],
"emailAddresses": [],
"emailAccountAdmins": true
}
},
{
"apiVersion": "2018-06-01-preview",
"type": "Microsoft.Sql/servers/vulnerabilityAssessments",
"name": "[concat(parameters('serverName'), '/Default')]",
"properties": {
"storageContainerPath": "[if(parameters('enableADS'), concat(reference(resourceId('Microsoft.Storage/storageAccounts', variables('storageName')), '2018-07-01').primaryEndpoints.blob, 'vulnerability-assessment'), '')]",
"storageAccountAccessKey": "[if(parameters('enableADS'), listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageName')), '2018-02-01').keys[0].value, '')]",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": true,
"emails": []
}
},
"dependsOn": [
"[concat('Microsoft.Sql/servers/', parameters('serverName'))]",
"[concat('Microsoft.Sql/servers/', parameters('serverName'), '/securityAlertPolicies/Default')]"
]
}
请注意,在此示例中,我假设您正在使用现有存储。 如果要在同一ARM模板中部署存储,则也必须为此添加依赖项(在“ dependsOn”下):
"[concat('Microsoft.Storage/storageAccounts/', variables('storageName'))]"
答案 1 :(得分:0)
我已通过将漏洞评估分为不同的资源块来解决此问题。而不是将其放在SQL资源块中。新的资源块如下所示:
{
"name": "[concat(parameters('sqlServerName'), '/vulnerabilityAssessments')]",
"type": "Microsoft.Sql/servers/vulnerabilityAssessments",
"apiVersion": "2018-06-01-preview",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Sql/servers/', parameters('sqlServerName'))]",
"[concat('Microsoft.Sql/servers/', parameters('sqlServerName'), '/databases/', parameters('databaseName'))]"
],
"properties": {
"storageContainerPath": "[concat('https://', parameters('storageAccountName'), '.blob.core.windows.net/vulnerability-assessment/')]",
"storageAccountAccessKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"emails": "[parameters('emailaddresses')]"
}
}
},