Question

添加terraform apply后，在运行azurerm_storage_share时出现以下错误。

Error: Error checking for existence of existing Storage Share "fileshare"
(Account "sttestforaddingfileshare" / Resource Group "resources"):
shares.Client#GetProperties: Failure responding to request: StatusCode=403
-- Original Error: autorest/azure: Service returned an error. 
Status=403 Code="AuthorizationFailure" 
Message="This request is not authorized to perform this operation.
\nRequestId:188ae38b-e01a-000b-35b3-a32ea2000000
\nTime:2020-10-16T11:55:16.7337008Z"

我认为原因很可能是Terraform试图列出直接访问存储帐户的REST API而不是Azure Resource Manager的REST API的存储帐户中的现有文件共享。

失败是因为存在不存在运行主机terraform的IP的防火墙规则。当我将笔记本电脑的IP添加到防火墙规则中时，它可以工作。但这不是期望的行为。

您知道任何解决方法吗？任何帮助表示赞赏。

我的TF配置如下：

provider "azurerm" {
  version     = "= 2.32.0"
  features {}
}
 
resource "azurerm_resource_group" "rg" {
  name     = "resources"
  location = var.location
}

resource "azurerm_virtual_network" "vnet" {
  name                = "vnet"
  location            = var.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "snet" {
  name                 = "snet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]
  
  service_endpoints = [ "Microsoft.Storage" ]
}

resource "azurerm_storage_account" "storage" {
  name                     = "sttestforaddingfileshare"
  resource_group_name      = azurerm_resource_group.rg.name

  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  network_rules {
    default_action             = "Deny"
    virtual_network_subnet_ids = [ azurerm_subnet.snet.id ]
    bypass = [ "None" ]
  }
}

resource "azurerm_storage_share" "file_share" {
    name                 = "fileshare"
    storage_account_name = azurerm_storage_account.storage.name
    quota                = 100
}

Answer 1

您可以使用azurerm_storage_account_network_rules资源来定义网络规则，并删除直接在azurerm_storage_account资源上定义的Network Rules块。

此外，您可以使用z CLI而不是单独的资源"azurerm_storage_share"

创建文件共享

在我验证之后，使用

PS D:\Terraform> .\terraform.exe -v
Terraform v0.13.4
+ provider registry.terraform.io/hashicorp/azurerm v2.32.0

在terraform apply和terraform destroy时有效。

resource "azurerm_storage_account" "storage" {
  name                     = "nnnstore1"
  resource_group_name      = azurerm_resource_group.rg.name

  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  
provisioner "local-exec" {
    command =<<EOT
    az storage share create `
    --account-name ${azurerm_storage_account.storage.name} `
    --account-key ${azurerm_storage_account.storage.primary_access_key} `
    --name ${var.myshare} `
    --quota 100   
    EOT

    interpreter = [ "Powershell", "-c"]
  }

}
   


resource "azurerm_storage_account_network_rules" "test" {
  resource_group_name  = azurerm_resource_group.rg.name
  storage_account_name = azurerm_storage_account.storage.name

  default_action             = "Deny"
  virtual_network_subnet_ids = [azurerm_subnet.snet.id]
  bypass                     = ["None"]
}

Answer 2

我最近在尝试为容器组创建存储共享时遇到了这个问题。它与您的代码几乎相同，但带有额外的容器组。

我在将堆栈部署为新的时遇到了这个问题，我通过部署除存储共享组件和对它的所有引用之外的所有内容来绕过该错误。

完成后，我引入了存储共享并重新部署，没有问题。

糟糕的解决方法，但再次部署。

将存储共享添加到Azure存储帐户时出错

2 个答案: