部署Azure AI OpenAI触发BringOwnFeatureNotEnabled错误求助

部署Azure OpenAI认知服务账户时触发400错误，系统检查订阅的BringYourOwnKey启用状态失败，错误信息如下：

Error: creating Account
│ Resource Group Name: "NP-OPENAI-RGP"
│ Account Name: "np-openai"): unexpected status 400 (400 Bad Request) with error: BringOwnFeatureNotEnabled: Bring your own feature is not enabled for Subscription/SKU/Kind.
│
│   with azurerm_cognitive_account.openai,
│   on openai.tf line 14, in resource "azurerm_cognitive_account" "openai":
│   14: resource "azurerm_cognitive_account" "openai" {

根据微软官方文档说明，Azure OpenAI无需申请该功能权限，已注释customer_managed_key配置，但仍触发错误。当前使用azurerm版本~>3.111.0，Terraform配置如下：

# OpenAI
resource "azurerm_cognitive_account" "openai" {
  kind                          = "OpenAI"
  name                          = var.openai_name
  resource_group_name           = azurerm_resource_group.openai-rg.name
  location                      = azurerm_resource_group.openai-rg.location
  sku_name                      = var.openai_cog_acct_sku
  custom_subdomain_name         = var.openai_name
  public_network_access_enabled = true
  tags = merge(local.base_tags,
    { Component = "Azure OpenAI" }
  )
  depends_on = [
    azurerm_key_vault_access_policy.openai,
    azurerm_user_assigned_identity.openai
  ]
  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.openai.id]
  }

  /* customer_managed_key {
    key_vault_key_id   = azurerm_key_vault_key.openai.id
    identity_client_id = azurerm_user_assigned_identity.openai.principal_id
  } */

  storage {
    storage_account_id = module.openai-sa.storage_acct_id
  }

  /* network_acls {
    default_action = "Deny"
    ip_rules = local.vpn
    virtual_network_rules {
      subnet_id = data.azurerm_subnet.np-vnet-subnets[var.np_subnet].id
      ignore_missing_vnet_service_endpoint = false
    }
  } */
}

解决方案 #

• 移除storage块配置：错误核心原因是配置了storage块，Azure OpenAI服务不支持自带存储（Bring Your Own Storage）功能，即使未配置客户托管密钥，只要声明storage块，Azure就会校验订阅的BringYourOwnFeature权限，从而触发报错。
• 清理Terraform状态残留：执行terraform state show azurerm_cognitive_account.openai查看当前资源状态，若存在customer_managed_key或storage的残留记录，使用terraform state rm azurerm_cognitive_account.openai移除状态后重新部署。
• 确认SKU有效性：检查使用的sku_name是否为Azure OpenAI支持的标准SKU（如S0），避免使用预览版或受限制的SKU。

内容的提问来源于stack exchange，提问作者NickP