Question

我试图用地变法来创建3个数据片,因为我遇到了403个错误。

我还试图创建SP 并设置Blob阅读器角色。

在下面找到我的代码和错误者

Terraform v1.2.1 on windows_amd64

provider registry.terraform.io/hashicorp/azuread v2.22.0
provider registry.terraform.io/hashicorp/azurerm v3.7.0

resource "azurerm_storage_data_lake_gen2_filesystem" "stg-datalake" {
  for_each           = toset(["bronze", "silver", "gold"])
  name               = each.value
  storage_account_id = azurerm_storage_account.stg-datalake.id

  ace {
    scope       = "access"
    type        = "user"
    id          = azurerm_data_factory.adf.identity[0].principal_id
    permissions = "rwx"
  }
}

Error: Error: checking for existence of existing File System "gold" (Account "stgaclientteste"): datalakestore.Client#GetProperties: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: error response cannot be parsed: {"" x00 x00 } error: EOF

Answer 1

问题数月后仍然存在, 因此我使用了下面的变通方法。 ADLS gen2 文件系统与常规存储容器有些不同, 您需要 < code> Storage Blob Data所有者来创建/ 更新文件系统。

data "azurerm_client_config" "current" {}

# HACK: Role assignment is needed to apply adls gen2 filesystem changes
resource "azurerm_role_assignment" "role_assignment" {
  scope                = var.storage_account_id
  role_definition_name = "Storage Blob Data Owner"
  principal_id         = data.azurerm_client_config.current.object_id
}

resource "azurerm_role_assignment" "role_assignment" {
  scope                = var.storage_account_id
  role_definition_name = "Contributor"
  principal_id         = data.azurerm_client_config.current.object_id
}

# HACK: Sleep is needed to wait for role assignment to propagate
resource "time_sleep" "role_assignment_sleep" {
  create_duration = "60s"

  triggers = {
    role_assignment = azurerm_role_assignment.role_assignment.id
  }
}

resource "azurerm_storage_data_lake_gen2_filesystem" "filesystem" {
  name               = var.filesystem_name
  storage_account_id = var.storage_account_id
  depends_on         = [time_sleep.role_assignment_sleep]
}

Answer 2

造成403 错误的原因:

public_network_access_enabled = false

如果您在本地重新测试, 您可以在 ip_ rules 列表中添加您的公共 IP :

resource "azurerm_storage_account" "lake" {
  # ...

  # Enable the access
  public_network_access_enabled = true

  # Control access with IP rules
  network_rules {
    default_action             = "Deny"
    ip_rules                   = [var.public_ip_address_to_allow]
    virtual_network_subnet_ids = [var.subnet_id]
    bypass                     = ["AzureServices"]
  }
}

在您的输油管中,比如在地貌云上,要将这一功能自动化,应该有可能得到>IP范围 ,并自动使用>hashicorp/http 提供者。

Answer 3

不要忘记集装箱及其目录的ACLs。

Answer 4

MT I had to set the permission to the Resource Group where the stgaccount where created.

设置为 stg 账户无效。

谢谢你的回答!

友情链接