Question

我按照以下顺序通过Azure门户创建了一些资源。

创建了一个具有两个子网的虚拟网络，其中一个subnet1启用了存储服务端点。
创建了一个存储帐户stgaccount1，然后在该存储帐户的防火墙设置上，添加了子网1。
创建了一个服务端点策略，该策略仅允许访问stgaccount1并将此策略与subnet1关联。

此设置对我来说很好，现在我想使其自动化，因此我为其生成了模板，但是仅查看模板，似乎模板中存在循环依赖关系，而当我尝试部署它时失败了如预期的那样。

依赖流看起来像这样。

服务终结点策略取决于存储帐户。
存储帐户取决于subnet1，因为仅该子网允许访问。
现在，由于子网也与ServiceEndpoint策略相关联，因此它依赖于Service End Point策略。

我不确定谁可以解决这个依赖关系链，或者正确的方法是什么。

下面是参考模板。

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymenttemplate.json#",
    "contentversion": "1.0.0.0",
    "parameters": {
        "virtual_network_name": {
            "defaultvalue": "vnet",
            "type": "string"
        },
        "serviceEndPointPolicyName": {
            "type": "string",
            "defaultvalue": "storageEndPointPolicy"
        }
    },
    "variables": {
        "storageAccountName": "[tolower(concat(resourceGroup().name, 'storageaccount'))]",
        "virtualNetworkName": "[concat(resourceGroup().name, parameters('virtual_network_name'))]"
    },
    "resources": [
        {
            "type": "Microsoft.Network/serviceEndpointPolicies",
            "apiVersion": "2019-11-01",
            "name": "[parameters('serviceEndPointPolicyName')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
            ],
            "properties": {
                "serviceEndpointPolicyDefinitions": [
                    {
                        "name": "[concat(parameters('serviceEndPointPolicyName'), '_Microsoft.Storage')]",
                        "properties": {
                            "service": "Microsoft.Storage",
                            "serviceResources": [
                                "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
                            ]
                        }
                    }
                ]
            }
        },
        {
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2019-06-01",
            "name": "[variables('storageAccountName')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'subent1')]"
            ],
            "sku": {
                "name": "Standard_RAGRS",
                "tier": "Standard"
            },
            "kind": "StorageV2",
            "properties": {
                "networkAcls": {
                    "bypass": "AzureServices",
                    "virtualNetworkRules": [
                        {
                            "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'subent1')]",
                            "action": "Allow",
                            "state": "Succeeded"
                        }
                    ],
                    "ipRules": [
                    ],
                    "defaultAction": "Deny"
                },
                "supportsHttpsTrafficOnly": false,
                "encryption": {
                    "services": {
                        "file": {
                            "keyType": "Account",
                            "enabled": true
                        },
                        "blob": {
                            "keyType": "Account",
                            "enabled": true
                        }
                    },
                    "keySource": "Microsoft.Storage"
                },
                "accessTier": "Hot"
            }
        },


        {
            "type": "Microsoft.Network/virtualNetworks",
            "apiVersion": "2019-11-01",
            "name": "[variables('virtualNetworkName')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
            ],
            "properties": {
                "addressSpace": {
                    "addressPrefixes": [
                        "10.0.0.0/16"
                    ]
                },
                "subnets": [
                    {
                        "name": "subnet2",
                        "properties": {
                            "addressPrefix": "10.0.1.0/24",
                            "delegations": [
                            ],
                            "privateEndpointNetworkPolicies": "Enabled",
                            "privateLinkServiceNetworkPolicies": "Enabled"
                        }
                    },
                    {
                        "name": "subent1",
                        "properties": {
                            "addressPrefix": "10.0.0.0/24",
                            "serviceEndpointPolicies": [
                                {
                                    "id": "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
                                }
                            ],
                            "serviceEndpoints": [
                                {
                                    "service": "Microsoft.Storage",
                                    "locations": [
                                        "*"
                                    ]
                                }
                            ],
                            "delegations": [
                            ],
                            "privateEndpointNetworkPolicies": "Enabled",
                            "privateLinkServiceNetworkPolicies": "Enabled"
                        }
                    }
                ],
                "virtualNetworkPeerings": [
                ],
                "enableDdosProtection": false,
                "enableVmProtection": false
            }
        },
        {
            "type": "Microsoft.Network/virtualNetworks/subnets",
            "apiVersion": "2019-11-01",
            "name": "[concat(variables('virtualNetworkName'), '/subent1')]",
            "dependsOn": [
                "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]",
                "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
            ],
            "properties": {
                "addressPrefix": "10.0.0.0/24",
                "serviceEndpointPolicies": [
                    {
                        "id": "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
                    }
                ],
                "serviceEndpoints": [
                    {
                        "service": "Microsoft.Storage",
                        "locations": [
                            "*"
                        ]
                    }
                ],
                "delegations": [
                ],
                "privateEndpointNetworkPolicies": "Enabled",
                "privateLinkServiceNetworkPolicies": "Enabled"
            }
        },
        {
            "type": "Microsoft.Network/virtualNetworks/subnets",
            "apiVersion": "2019-11-01",
            "name": "[concat(variables('virtualNetworkName'), '/subnet2')]",
            "dependsOn": [
                "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
            ],
            "properties": {
                "addressPrefix": "10.0.1.0/24",
                "delegations": [
                ],
                "privateEndpointNetworkPolicies": "Enabled",
                "privateLinkServiceNetworkPolicies": "Enabled"
            }
        }

    ]
}

Answer 1

除了导出问题外，请按照在门户中遵循的模板（顺序）中的相同步骤进行操作。下面是我的版本...本质上，您将首先在没有策略的情况下部署vnet，然后在以后添加策略...

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymenttemplate.json#",
"contentversion": "1.0.0.0",
"parameters": {
    "virtual_network_name": {
        "defaultvalue": "vnet",
        "type": "string"
    },
    "serviceEndPointPolicyName": {
        "type": "string",
        "defaultvalue": "storageEndPointPolicy"
    }
},
"variables": {
    "storageAccountName": "[uniqueString(resourceGroup().id)]",
    "virtualNetworkName": "[parameters('virtual_network_name')]"
},
"resources": [
    {
        "type": "Microsoft.Network/virtualNetworks",
        "apiVersion": "2019-11-01",
        "name": "[variables('virtualNetworkName')]",
        "location": "eastus",
        "properties": {
            "addressSpace": {
                "addressPrefixes": [
                    "10.0.0.0/16"
                ]
            },
            "subnets": [
                {
                    "name": "subnet2",
                    "properties": {
                        "addressPrefix": "10.0.1.0/24",
                        "delegations": [
                        ],
                        "privateEndpointNetworkPolicies": "Enabled",
                        "privateLinkServiceNetworkPolicies": "Enabled"
                    }
                },
                {
                    "name": "subent1",
                    "properties": {
                        "addressPrefix": "10.0.0.0/24",
                        "serviceEndpoints": [
                            {
                                "service": "Microsoft.Storage",
                                "locations": [
                                    "*"
                                ]
                            }
                        ],
                        "privateEndpointNetworkPolicies": "Enabled",
                        "privateLinkServiceNetworkPolicies": "Enabled"
                    }
                }
            ],
            "enableDdosProtection": false,
            "enableVmProtection": false
        }
    },
    {
        "type": "Microsoft.Storage/storageAccounts",
        "apiVersion": "2019-06-01",
        "name": "[variables('storageAccountName')]",
        "location": "eastus",
        "dependsOn": [
            "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
        ],
        "sku": {
            "name": "Standard_RAGRS",
            "tier": "Standard"
        },
        "kind": "StorageV2",
        "properties": {
            "networkAcls": {
                "bypass": "AzureServices",
                "virtualNetworkRules": [
                    {
                        "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'subent1')]",
                        "action": "Allow",
                        "state": "Succeeded"
                    }
                ],
                "defaultAction": "Deny"
            },
            "supportsHttpsTrafficOnly": false,
            "encryption": {
                "services": {
                    "file": {
                        "keyType": "Account",
                        "enabled": true
                    },
                    "blob": {
                        "keyType": "Account",
                        "enabled": true
                    }
                },
                "keySource": "Microsoft.Storage"
            },
            "accessTier": "Hot"
        }
    },
    {
        "type": "Microsoft.Network/serviceEndpointPolicies",
        "apiVersion": "2019-11-01",
        "name": "[parameters('serviceEndPointPolicyName')]",
        "location": "eastus",
        "dependsOn": [
            "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]",
            "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
        ],
        "properties": {
            "serviceEndpointPolicyDefinitions": [
                {
                    "name": "[concat(parameters('serviceEndPointPolicyName'), '_Microsoft.Storage')]",
                    "properties": {
                        "service": "Microsoft.Storage",
                        "serviceResources": [
                            "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
                        ]
                    }
                }
            ]
        }
    },
    {
        "type": "Microsoft.Network/virtualNetworks/subnets",
        "apiVersion": "2019-11-01",
        "name": "[concat(variables('virtualNetworkName'), '/subent1')]",
        "dependsOn": [
            "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
        ],
        "properties": {
            "addressPrefix": "10.0.0.0/24",
            "serviceEndpointPolicies": [
                {
                    "id": "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
                }
            ],
            "serviceEndpoints": [
                {
                    "service": "Microsoft.Storage",
                    "locations": [
                        "*"
                    ]
                }
            ],
            "privateEndpointNetworkPolicies": "Enabled",
            "privateLinkServiceNetworkPolicies": "Enabled"
        }
    }
]
}

ARM模板循环/循环依赖关系解析

1 个答案: