Terraform Azurerm 3.x部署存储账户遇超时错误，请求协助解决

我使用最新版本Terraform，azurerm provider指定为~>3.0，执行部署时遇到以下超时错误：

Error: retrieving static website properties for Storage Account (Subscription: *** : context deadline exceeded

以下是我的完整Terraform代码：

resource "azurerm_storage_account" "sa-int" {
  name                             = .......
  resource_group_name              = data.azurerm_resource_group.rg.name
  location                         = data.azurerm_resource_group.rg.location
  account_tier                     = "Standard"
  account_replication_type         = "LRS"
  allow_nested_items_to_be_public  = false
  cross_tenant_replication_enabled = false
  min_tls_version                  = "TLS1_2"
  identity {
    type = "SystemAssigned"
  }
  timeouts {
    create = "1h"
    update = "30m"
    delete = "30m"
  }  
  blob_properties {
    delete_retention_policy {
      days = 30
    }
    container_delete_retention_policy {
      days = 30
    }

  }
  queue_properties {
    logging {
      delete                = true
      read                  = true
      write                 = true
      version               = "1.0"
      retention_policy_days = 10
    }
    hour_metrics {
      enabled               = true
      include_apis          = true
      retention_policy_days = 10
      version               = "1.0"

    }
    minute_metrics {
      enabled               = true
      include_apis          = true
      retention_policy_days = 10
      version               = "1.0"


    }

  }
}

resource "azurerm_storage_container" "container" {
  count                 = length(var.containername)
  name                  = element(var.containername, count.index)
  storage_account_name  = azurerm_storage_account.sa-int.name
  container_access_type = "private"
  depends_on            = [azurerm_storage_account.sa-int]

}

resource "null_resource" "log" {

  triggers = {
    always_run = timestamp()
  }
  depends_on = [
    azurerm_storage_container.container
  ]
  provisioner "local-exec" {
    command = "az storage logging update --log rwd --retention 30 --services qtb --account-name ${azurerm_storage_account.sa-int.name} --account-key ${azurerm_storage_account.sa-int.primary_access_key}"
  }
}

resource "azurerm_private_endpoint" "endpoint" {

  name                = ........
  resource_group_name = data.azurerm_resource_group.rgnetwork.name
  location            = data.azurerm_resource_group.rgnetwork.location
  subnet_id           = data.azurerm_subnet.subnet.id
  private_dns_zone_group {
    name                 = .........
    private_dns_zone_ids = [data.azurerm_private_dns_zone.dns.id]
  }
  private_service_connection {
    name                           = ........
    is_manual_connection           = false
    private_connection_resource_id = azurerm_storage_account.sa-int.id
    subresource_names              = ["blob"]
  }

  depends_on = [null_resource.log]
}

resource "azurerm_private_dns_a_record" "record" {

  provider            = azurerm.sub
  name                = azurerm_storage_account.sa-int.name
  zone_name           = data.azurerm_private_dns_zone.dns.name
  resource_group_name = data.azurerm_resource_group.rg.name
  ttl                 = 10
  records             = [azurerm_private_endpoint.endpoint.private_service_connection[0].private_ip_address]
  depends_on          = [azurerm_private_endpoint.endpoint]
}

resource "azurerm_storage_account_network_rules" "nwrule" {

  storage_account_id         = azurerm_storage_account.sa-int.id
  default_action             = "Deny"
  virtual_network_subnet_ids = [data.azurerm_subnet.subnet.id]
  bypass                     = ["AzureServices"]
  depends_on                 = [azurerm_private_dns_a_record.record]
}

resource "azurerm_key_vault_access_policy" "storage" {
  key_vault_id = data.azurerm_key_vault.kv.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_storage_account.sa-int.identity.0.principal_id

  key_permissions    = ["Get", "List"]
  secret_permissions = ["Get"]

  depends_on = [azurerm_storage_account.sa-int]
}

排查与解决方法 #

1. 显式禁用静态网站属性检查 #

错误提示为获取静态网站属性超时，但配置中并未启用静态网站。Terraform默认会尝试查询该属性，显式禁用可避免不必要的API调用：

resource "azurerm_storage_account" "sa-int" {
  # 保留原有配置...
  static_website {
    enabled = false
  }
}

2. 调整网络规则的应用时机与访问权限 #

azurerm_storage_account_network_rules.nwrule设置了default_action = "Deny"，且依赖私有DNS记录，导致Terraform后续检查存储账户属性时，公共端点已被拒绝，而私有DNS解析可能未生效，引发超时。

• 临时添加Terraform运行机器的公网IP到允许列表：

resource "azurerm_storage_account_network_rules" "nwrule" {
  storage_account_id         = azurerm_storage_account.sa-int.id
  default_action             = "Deny"
  virtual_network_subnet_ids = [data.azurerm_subnet.subnet.id]
  bypass                     = ["AzureServices"]
  ip_rules                   = ["你的Terraform运行机器公网IP/32"] # 添加此配置
  depends_on                 = [azurerm_private_endpoint.endpoint] # 无需等待DNS记录
}

• 若Terraform运行在Azure VNet内，确保子网已加入允许列表，且私有端点DNS解析正常。

3. 移除冗余的null_resource外部命令 #

azurerm_storage_account已配置queue的日志规则，无需通过local-exec调用az cli重复设置。删除null_resource.log，减少外部依赖与网络风险：

# 删除以下资源
resource "null_resource" "log" {
  # ...原有配置
}

同时调整azurerm_private_endpoint.endpoint的依赖为直接关联存储容器：

resource "azurerm_private_endpoint" "endpoint" {
  # 保留原有配置...
  depends_on = [azurerm_storage_container.container]
}

4. 延长Provider API超时时间 #

在azurerm provider配置中增加API调用超时，适配Azure可能的响应延迟：

provider "azurerm" {
  features {}
  timeout {
    create = "30m"
    read   = "10m"
    update = "30m"
    delete = "30m"
  }
}

5. 检查私有端点子资源配置 #

确保私有端点的subresource_names包含所有需要访问的存储服务类型，若需要操作queue、table等，需补充对应子资源：

private_service_connection {
  # 保留原有配置...
  subresource_names = ["blob", "queue"] # 根据需求添加
}

内容的提问来源于stack exchange，提问作者Izzy