为Function App分配Storage Blob Data Contributor角色时遇InvalidCreateRoleAssignmentRequest错误

尝试为Function App分配Storage Blob Data Contributor角色，使其能访问存储账户并从容器下载文件，编写了两段ARM模板代码：

第一段代码：

{
  "type": "Microsoft.Authorization/roleAssignments",
  "apiVersion": "2020-10-01-preview",
  "name": "[guid(variables('functionAppName'), 'storageAccountAccessRole')]",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]"
  ],
  "properties": {
    "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'xxxxxxxxxxxxxxx')]", // Storage Blob Data Contributor
    "principalId": "[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2021-01-15', 'full').identity.principalId]",
    "scope": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Storage/storageAccounts/', parameters('StorageAccountName'))]"
  }
}

第二段代码：

{
    "type": "Microsoft.Authorization/roleAssignments",
    "apiVersion": "2020-10-01-preview",
    "name": "[guid(variables('functionAppName'), 'storageAccountAccessRole')]",
    "dependsOn": [
        "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]"
    ],
    "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'xxxxxxxxxxxxxxxxxxxx')]", // Storage Blob Data Contributor
        "principalId": "[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2021-01-15', 'full').identity.principalId]",
        "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName'))]"
    }
}

两段代码均返回错误：

##[error]InvalidCreateRoleAssignmentRequest: The request to create role assignment 'xxxxxxxxxxxxxx' is not valid. Role assignment scope '/subscriptions/yyyyyyyyyyyy/resourceGroups/zzzzzzz-rg/providers/Microsoft.Storage/storageAccounts/StorageAccountName' must match the scope specified on the URI '/subscriptions/yyyyyyyyyyy/resourcegroups/zzzzzzzz-rg'.

两个资源同属一个资源组，需要存储账户/容器级作用域，如何解决该作用域不匹配问题？

解决思路 #

1. 调整角色分配的部署层级 #

错误核心是角色分配资源的部署作用域（URI中的scope）必须与properties里指定的权限作用域一致。当前是在资源组层级部署roleAssignments，但权限作用域指向了存储账户，导致不匹配。

要给存储账户分配角色，需将Microsoft.Authorization/roleAssignments资源的部署级别设置为存储账户级别，示例代码如下：

{
  "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
  "apiVersion": "2020-10-01-preview",
  "name": "[concat(parameters('StorageAccountName'), '/Microsoft.Authorization/', guid(variables('functionAppName'), 'storageAccountAccessRole'))]",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
    "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName'))]"
  ],
  "properties": {
    "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", // Storage Blob Data Contributor内置角色ID
    "principalId": "[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2021-01-15', 'full').identity.principalId]"
  }
}

2. 容器级细粒度权限实现 #

如果需要仅给特定容器分配权限，只需调整资源类型和名称，将部署作用域指向目标容器：

{
  "type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
  "apiVersion": "2020-10-01-preview",
  "name": "[concat(parameters('StorageAccountName'), '/default/', parameters('containerName'), '/Microsoft.Authorization/', guid(variables('functionAppName'), 'containerAccessRole'))]",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
    "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('StorageAccountName'), 'default', parameters('containerName'))]"
  ],
  "properties": {
    "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
    "principalId": "[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2021-01-15', 'full').identity.principalId]"
  }
}

3. 关键注意事项 #

• 确保Function App已启用系统分配或用户分配的托管标识，否则principalId会获取失败。
• Storage Blob Data Contributor的内置角色ID为固定值ba92f5b4-2d11-453d-a403-e96b0029c9fe，可直接替换模板中的占位符。
• 部署模板时，执行用户需拥有对应层级（存储账户/容器）的角色分配创建权限。

内容的提问来源于stack exchange，提问作者Learning azure