如何通过ARM模板在StorageAccount中设置选定的网络

时间:2019-09-03 08:52:20

标签: azure arm azure-storage vnet

我具有以下ARM模板来生成存储帐户并添加现有虚拟网络:

   {
      "name": "test0deep0123",
      "type": "Microsoft.Storage/storageAccounts",
      "location": "West Europe",
      "apiVersion": "2018-11-01",
      "sku": {
        "name": "Standard_LRS",
        "tier": "Standard"
      },
      "kind": "StorageV2",
      "properties": {
        "firewallState": "Enabled",
        "virtualNetworkRules": [
          {
            "properties": {
              "subnetId": "subnetid"
            },
            "name": "name"
          },
          {
            "properties": {
              "subnetId": "subnetId"
            },
            "name": "name"
          },
          {
            "properties": {
              "subnetId": "subnetid"
            },
            "name": "name"
          },
          {
            "properties": {
              "subnetId": "subnetid"
            },
            "name": "name"
          },
          {
            "properties": {
              "subnetId": "subnetid"
            },
            "name": "name"
          },
          {
            "properties": {
              "subnetId": subnetid"
            },
            "name": "name"
          },
          {
            "properties": {
              "subnetId": "subnetid"
            },
            "name": "name"
          }

        "networkAcls": {
          "bypass": "AzureServices",
          "virtualNetworkRules": [
            {
              "id": "id",
              "action": "Allow",
              "state": "succeeded"
            },
            {
              "id": "id",
              "action": "Allow",
              "state": "succeeded"
            }
          ],
          "ipRules": [],
          "defaultAction": "Allow"
        },
        "supportsHttpsTrafficOnly": false,
        "encryption": {
          "services": {
            "file": {
              "enabled": true
            },
            "blob": {
              "enabled": true
            }
          },
          "keySource": "Microsoft.Storage"
        },
        "accessTier": "Hot"
      }
    }

我可以成功地在资源组中部署此模板,但是在控制“防火墙和虚拟网络”之后,我看到,允许从设置访问所有网络,尽管在所选网络下,我可以看到添加的虚拟网络 enter image description here

我应该如何检查“选定的网络”?

1 个答案:

答案 0 :(得分:1)

问题是,如果将virtualNetworkRules设置为allow,则defaultAction需要设置为Deny,因此您将防火墙中选定的虚拟网络列入白名单。存储帐户。

在这种情况下,您可以为段networkAcls选择现有的虚拟网络ID(enable the storage account service endpoint)并更改"defaultAction": "Deny"。同样,virtualNetworkRules属于networkAcls,而不是存储帐户的属性。

下面的模板可以在我这边工作。

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
            "virtualNetworks_vnet1": {
            "defaultValue": "/subscriptions/xxx/resourceGroups/myrg/providers/Microsoft.Network/virtualNetworks/vnet",
            "type": "string"
        },
            "virtualNetworks_vnet2": {
            "defaultValue": "/subscriptions/xxx/resourceGroups/myrg/providers/Microsoft.Network/virtualNetworks/mytestvnet1",
            "type": "string"
        }
    },
    "resources": [
        {
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2018-11-01",
            "name": "test0deep01234",
            "location": "Central US",
            "sku": {
                "name": "Standard_LRS",
                "tier": "Standard"
            },
            "kind": "StorageV2",
            "properties": {
                "networkAcls": {
                    "bypass": "AzureServices",
                    "virtualNetworkRules": [
                        {
                            "id": "[concat(parameters('virtualNetworks_vnet1'), '/subnets/default')]",
                            "action": "Allow"

                        },
                         {
                            "id": "[concat(parameters('virtualNetworks_vnet2'), '/subnets/default')]",
                            "action": "Allow"

                        }
                    ],
                    "ipRules": [],
                    "defaultAction": "Deny"
                },
                "supportsHttpsTrafficOnly": false,
                "encryption": {
                    "services": {
                        "file": {
                            "enabled": true
                        },
                        "blob": {
                            "enabled": true
                        }
                    },
                    "keySource": "Microsoft.Storage"
                },
                "accessTier": "Hot"
            }
        }
    ]
}

enter image description here

参考:Microsoft.Storage storageAccounts template reference