我具有以下ARM模板来生成存储帐户并添加现有虚拟网络:
{
"name": "test0deep0123",
"type": "Microsoft.Storage/storageAccounts",
"location": "West Europe",
"apiVersion": "2018-11-01",
"sku": {
"name": "Standard_LRS",
"tier": "Standard"
},
"kind": "StorageV2",
"properties": {
"firewallState": "Enabled",
"virtualNetworkRules": [
{
"properties": {
"subnetId": "subnetid"
},
"name": "name"
},
{
"properties": {
"subnetId": "subnetId"
},
"name": "name"
},
{
"properties": {
"subnetId": "subnetid"
},
"name": "name"
},
{
"properties": {
"subnetId": "subnetid"
},
"name": "name"
},
{
"properties": {
"subnetId": "subnetid"
},
"name": "name"
},
{
"properties": {
"subnetId": subnetid"
},
"name": "name"
},
{
"properties": {
"subnetId": "subnetid"
},
"name": "name"
}
"networkAcls": {
"bypass": "AzureServices",
"virtualNetworkRules": [
{
"id": "id",
"action": "Allow",
"state": "succeeded"
},
{
"id": "id",
"action": "Allow",
"state": "succeeded"
}
],
"ipRules": [],
"defaultAction": "Allow"
},
"supportsHttpsTrafficOnly": false,
"encryption": {
"services": {
"file": {
"enabled": true
},
"blob": {
"enabled": true
}
},
"keySource": "Microsoft.Storage"
},
"accessTier": "Hot"
}
}
我可以成功地在资源组中部署此模板,但是在控制“防火墙和虚拟网络”之后,我看到,允许从设置访问所有网络,尽管在所选网络下,我可以看到添加的虚拟网络
我应该如何检查“选定的网络”?
答案 0 :(得分:1)
问题是,如果将virtualNetworkRules
设置为allow
,则defaultAction
需要设置为Deny
,因此您将防火墙中选定的虚拟网络列入白名单。存储帐户。
在这种情况下,您可以为段networkAcls
选择现有的虚拟网络ID(enable the storage account service endpoint)并更改"defaultAction": "Deny"
。同样,virtualNetworkRules
属于networkAcls
,而不是存储帐户的属性。
下面的模板可以在我这边工作。
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"virtualNetworks_vnet1": {
"defaultValue": "/subscriptions/xxx/resourceGroups/myrg/providers/Microsoft.Network/virtualNetworks/vnet",
"type": "string"
},
"virtualNetworks_vnet2": {
"defaultValue": "/subscriptions/xxx/resourceGroups/myrg/providers/Microsoft.Network/virtualNetworks/mytestvnet1",
"type": "string"
}
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2018-11-01",
"name": "test0deep01234",
"location": "Central US",
"sku": {
"name": "Standard_LRS",
"tier": "Standard"
},
"kind": "StorageV2",
"properties": {
"networkAcls": {
"bypass": "AzureServices",
"virtualNetworkRules": [
{
"id": "[concat(parameters('virtualNetworks_vnet1'), '/subnets/default')]",
"action": "Allow"
},
{
"id": "[concat(parameters('virtualNetworks_vnet2'), '/subnets/default')]",
"action": "Allow"
}
],
"ipRules": [],
"defaultAction": "Deny"
},
"supportsHttpsTrafficOnly": false,
"encryption": {
"services": {
"file": {
"enabled": true
},
"blob": {
"enabled": true
}
},
"keySource": "Microsoft.Storage"
},
"accessTier": "Hot"
}
}
]
}