Azure 二头肌在不同订阅/资源组中的存储帐户上设置角色分配

Question

我有以下二头肌文件

param accountName string
param roleId string
param principalId string

resource account 'Microsoft.Storage/storageAccounts@2022-09-01' existing = {
  name: accountName
}

resource roleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
  scope: account
  name: roleId
}

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2023-04-15' = {
  scope: account
  name: guid(account.id, principalId, roleDefinition.id)
  properties: {
    roleDefinitionId: roleDefinition.id
    principalId: principalId
    principalType: 'ServicePrincipal'
  }
}

执行此操作时，错误是它无法在运行的资源组中找到帐户 {accountName}，但是我尝试在另一个订阅/资源组中已存在的 storageAccount 上设置 roleAssignment。由于存储帐户名称是唯一的，我认为这应该可行吗？

Answer 1

您应该在这里使用二头肌模块。组合

modules

+

scope

两个关键字可以帮助您实现跨资源组的嵌套部署。

针对您的情况，我编写了一个示例并进行了测试。

main.bicep

param roleId string
param principalId string

param storageAccountRgName string
param storageAccountName string

module asModule 'roleAssign.bicep' = {
  scope: resourceGroup(storageAccountRgName)
  name: 'deploymentRoleAssign'
  params: {
    accountName: storageAccountName
    principalId: principalId
    roleId: roleId
  }
}

roleAssign.bicep

param accountName string
param roleId string
param principalId string

resource account 'Microsoft.Storage/storageAccounts@2022-09-01' existing = {
  name: accountName
}

resource roleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
  scope: account
  name: roleId
}

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: account
  name: guid(account.id, principalId, roleDefinition.id)
  properties: {
    roleDefinitionId: roleDefinition.id
    principalId: principalId
    principalType: 'ServicePrincipal'
  }
}

deploy.ps1

$rgName = "wb-deployment-rg"
$location = "eastus"

$storageAccountRgName = "wb-sa-rg"
$storageAccountName = "wbsaxxx"

$roleId = 'xxxxx'
$principalId = 'xxxx'

New-AzResourceGroup -Name $rgName -Location $location -Force

$templateFile = "main.bicep"

$params = @{
  roleId = $roleId
  principalId = $principalId
  storageAccountRgName = $storageAccountRgName
  storageAccountName = $storageAccountName
}

New-AzResourceGroupDeployment `
  -Name 'wbtest' `
  -ResourceGroupName $rgName `
  -TemplateFile $templateFile `
  -TemplateParameterObject $params