创建带专用端点的Blob Storage容器时遇Terraform 403授权错误

问题描述 #

创建带专用端点的Blob Storage容器时，存储账户成功创建，但容器资源报403错误：

Error: checking for existing Container "my-container-name"  (Account "Account \"mystorageaccountname\" (IsEdgeZone false / ZoneName \"\" / Subdomain Type \"blob\" / DomainSuffix \"core.windows.net\")"): executing request: unexpected status 403 (403 This request is not authorized to perform this operation.) with AuthorizationFailure: This request is not authorized to perform this operation

已确认Terraform用户拥有创建云资源的角色权限，相关配置如下：

resource "azurerm_storage_account" "main" {
  name                            = "${local.lower_service_name}${local.lower_slug_environment}storage"
  resource_group_name             = azurerm_resource_group.main.name
  location                        = azurerm_resource_group.main.location
  account_tier                    = "Standard"
  account_replication_type        = "LRS" # Locally Redundant Storage
  account_kind                    = "StorageV2"
  public_network_access_enabled   = false
  default_to_oauth_authentication = true
  https_traffic_only_enabled      = true
  min_tls_version                 = "TLS1_2"

  blob_properties {
    versioning_enabled            = true
    change_feed_enabled           = true
    change_feed_retention_in_days = 90
    last_access_time_enabled      = true
    delete_retention_policy {
      days = 90
    }

    container_delete_retention_policy {
      days = 30
    }
  }
}

resource "azurerm_storage_account_network_rules" "main" {
  storage_account_id         = azurerm_storage_account.main.id
  default_action             = "Deny"
  ip_rules                   = []
  bypass                     = ["AzureServices"]
  virtual_network_subnet_ids = [module.storage_account_subnet.subnets_information["private-${local.service_name}-StorageAccount-1"].id]
}
# tfsec:ignore:azure-storage-no-public-access
resource "azurerm_storage_container" "main" {
  name                  = "${local.lower_service_name}-${local.lower_environment}-storage-container"
  storage_account_name  = azurerm_storage_account.main.name
  container_access_type = "private"
}
resource "azurerm_storage_blob" "main" {
  name                   = "${local.lower_service_name}-${local.lower_environment}"
  storage_account_name   = azurerm_storage_account.main.name
  storage_container_name = azurerm_storage_container.main.name
  type                   = "Block"
  access_tier            = "Hot"
}

原因分析及解决方案 #

1. 缺失专用端点资源配置 #

存储账户网络规则指定了允许特定子网访问，但未创建对应的专用端点，导致存储账户无专用网络接入路径，Terraform无法通过该子网访问存储账户。需添加专用端点配置：

resource "azurerm_private_endpoint" "storage_blob" {
  name                = "${local.lower_service_name}-${local.lower_environment}-storage-pe"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  subnet_id           = module.storage_account_subnet.subnets_information["private-${local.service_name}-StorageAccount-1"].id

  private_service_connection {
    name                           = "${local.lower_service_name}-storage-pe-conn"
    private_connection_resource_id = azurerm_storage_account.main.id
    subresource_names              = ["blob"] # 指定Blob服务的专用端点
    is_manual_connection           = false
  }
}

2. Terraform执行环境不在允许的子网内 #

若Terraform运行在本地机器或未加入指定子网的CI/CD服务器，即使配置了专用端点，执行环境也无法访问存储账户。可选解决方式：

• 将Terraform执行环境部署到指定子网（如Azure VM、Azure DevOps私有代理）
• 调试阶段临时添加执行环境的公网IP到存储账户网络规则：
  修改azurerm_storage_account_network_rules的ip_rules字段：

  ip_rules = ["你的公网IP/32"]
  

• 使用Azure Cloud Shell执行Terraform，Cloud Shell属于Azure服务，可通过bypass = ["AzureServices"]规则访问存储账户。

3. RBAC权限问题 #

• 确认Terraform身份（服务主体/用户）拥有存储Blob数据参与者角色，且角色作用域覆盖目标存储账户（而非仅资源组）。
• Azure RBAC权限存在生效延迟，若刚分配权限，等待5-10分钟后重新执行Terraform。

4. 默认OAuth认证的影响 #

配置中default_to_oauth_authentication = true强制使用OAuth认证，需确保：

• Terraform使用的身份已被授予Blob服务的OAuth权限
• Terraform通过正确方式完成OAuth认证（如Azure CLI登录、设置服务主体环境变量）

内容的提问来源于stack exchange，提问作者José Angel Badillo