“Microsoft.Sql/servers/auditingSettings” 要求对非 vnet 存储帐户进行 StorageBlobContributor 访问

Posted 2023-03-28

【中文标题】“Microsoft.Sql/servers/auditingSettings” 要求对非 vnet 存储帐户进行 StorageBlobContributor 访问

【英文标题】："Microsoft.Sql/servers/auditingSettings" asking for StorageBlobContributor access for non-vnet Storage Account

【发布时间】：2021-06-22 22:49:46

【问题描述】：

我正在通过 ARM 模板部署 SQL Server。使用存储帐户设置此 sql 服务器的审核设置时，它正在请求权限。

根据link，我们需要权限，仅当存储帐户位于防火墙后面时。但是，我的存储帐户对 Internet 是开放的，因此此处不应应用权限先决条件。

我已使用 Powershell cmdlet 'Set-AzSqlServerAudit' 来设置此配置，并且可以正常工作。但这在 ARM 模板中失败了。

模板sn-p：

            "type": "Microsoft.Sql/servers/auditingSettings",
            "apiVersion": "2020-08-01-preview",
            "name": "[concat(parameters('serverName'), '/Default')]",
            "dependsOn": [
                "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
            ],
            "properties": 
                "isDevopsAuditEnabled": false,
                "retentionDays": 0,
                "auditActionsAndGroups": [
                    "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
                    "FAILED_DATABASE_AUTHENTICATION_GROUP",
                    "BATCH_COMPLETED_GROUP"
                ],
                "isStorageSecondaryKeyInUse": false,
                "isAzureMonitorTargetEnabled": false,
                "state": "Enabled",
                "storageEndpoint": "[parameters('centralMonitoringStorageAccount')]",
                "storageAccountSubscriptionId": "[parameters('centralMonitoringStorageAccountSubscriptionId')]"
            
        ,

错误：

New-AzResourceGroupDeployment : 4:37:56 AM - Resource Microsoft.Sql/servers/auditingSettings 'coe-extollo-apis-sqlserver-dev/Default' failed with message '
  "status": "Failed",
  "error": 
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      
        "code": "BlobAuditingInsufficientStorageAccountPermissions",
        "message": "Insufficient read or write permissions on storage account 'xtocoeeucommonsdev'. Add permissions to the server Identity to the storage account."
      
    ]
  
'

【参考方案1】：

关于这个问题，如果您没有在模板中添加storageAccountAccessKey，那么 SQL 服务器没有访问存储帐户的权限。如果不添加，则需要在 Azure SQL 服务器上启用标识，并将Storage Blob Data Contributor 分配给存储帐户级别的标识。然后 SQL 可以拥有访问存储帐户的权限。更多详情请参考here。

所以请更新您的模板如下。

            "type": "Microsoft.Sql/servers/auditingSettings",
            "apiVersion": "2020-08-01-preview",
            "name": "[concat(parameters('serverName'), '/Default')]",
            "dependsOn": [
                "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
            ],
            "properties": 
                "isDevopsAuditEnabled": false,
                "retentionDays": 0,
                "auditActionsAndGroups": [
                    "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
                    "FAILED_DATABASE_AUTHENTICATION_GROUP",
                    "BATCH_COMPLETED_GROUP"
                ],
                "isStorageSecondaryKeyInUse": false,
                "isAzureMonitorTargetEnabled": false,
                "state": "Enabled",
                "storageEndpoint": "[parameters('centralMonitoringStorageAccount')]",
                "storageAccountAccessKey":"<account key>"
                "storageAccountSubscriptionId": "[parameters('centralMonitoringStorageAccountSubscriptionId')]"
            
        ,