使用Terraform部署Azure存储账户容器时遇403授权错误求助

问题描述 #

我在论坛搜了很多相关问题都没找到妥善解决办法。用Terraform部署Azure存储账户（SA）并创建容器时，首次部署遇到403授权失败错误，但再次执行terraform apply时容器却能成功创建。我怀疑是创建容器时存储账户尚未完全就绪导致的，想请教具体原因和解决办法。

错误信息 #

Error: containers.Client#GetProperties: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailure" Message="This request is not authorized to perform this operation.
RequestId:51828c6f-d01e-0037-297b-b2f7b5000000
Time:2024-05-30T10:25:34.2404478Z"
│ 
│   with module.global.module.stxxst01xxenv-containers.azurerm_storage_container.main["custom_container_name"],
│   on ../../modules/storage-account/storage-container/main.tf line 4, in resource "azurerm_storage_container" "main":
│    4: resource "azurerm_storage_container" "main" {

所用Terraform代码 #

# Create the RG
module "rg-da-stmain-xxxx-env" {
  source              = "../modules/resource-group"
  resource_group_name = "rg-da-stmain-xxxx-${var.environment}"
  location            = "West Europe"
  tags = {
    application = "x"
    created-by  = "x"
    deployer    = "x"
    stage       = var.environment
    team        = "x"
  }
}

# Create the Storage Account
module "stxxst01xxenv" {
  source                           = "../modules/storage-account"
  resource_group_name              = module.rg-da-stmain-xxxx-env.resource_group_name
  location                         = module.rg-da-stmain-xxxx-env.resource_group_location
  storage_account_name             = "stxxst01xx${var.environment}"
  storage_account_replication_type = "RAGRS"
  storage_account_tier             = "Standard"
  public_network_access_enabled    = false
  tags = {
    application = "x"
    created-by  = "x"
    deployer    = "x"
    stage       = var.environment
    team        = "x"
  }
  depends_on = [module.rg-da-stmain-xxxx-env]
}

# Create the Containers
module "stxxst01xxenv-containers" {
  source                = "../modules/storage-account/storage-container"
  storage_account_name  = module.stxxst01xxenv.storage_account_name
  container_access_type = "private"
  storage_containers    = ["custom_container_name"]
  depends_on            = [module.stxxst01xxenv]
}

原因分析 #

你的怀疑完全正确，核心问题在于Azure存储账户的"最终一致性"特性：

• Terraform通过depends_on确保存储账户的创建请求被Azure API标记为完成，但Azure后台需要额外时间完成资源初始化、权限同步等操作；
• 首次创建容器时，服务主体的订阅级权限（Contributor + Storage Blob Data Contributor）还未在新创建的存储账户层面完全生效，导致请求被拒绝；
• 重试时，存储账户的后台初始化已完成，权限同步到位，因此请求成功。

解决方案 #

1. 添加显式等待逻辑 #

在容器模块前加入time_sleep资源，给存储账户留足初始化时间（建议60秒以上，可根据实际情况调整）：

resource "time_sleep" "wait_for_sa_ready" {
  create_duration = "60s"
  depends_on = [module.stxxst01xxenv]
}

module "stxxst01xxenv-containers" {
  source                = "../modules/storage-account/storage-container"
  storage_account_name  = module.stxxst01xxenv.storage_account_name
  container_access_type = "private"
  storage_containers    = ["custom_container_name"]
  depends_on            = [time_sleep.wait_for_sa_ready]
}

2. 依赖存储账户的具体就绪属性 #

不要仅依赖模块的创建完成状态，而是让容器资源依赖存储账户的primary_access_key等属性——Terraform会等待该属性可用后才执行容器创建，间接确保账户完全就绪：

module "stxxst01xxenv-containers" {
  source                = "../modules/storage-account/storage-container"
  storage_account_name  = module.stxxst01xxenv.storage_account_name
  container_access_type = "private"
  storage_containers    = ["custom_container_name"]
  # 依赖存储账户访问密钥，确保账户初始化完成
  depends_on            = [module.stxxst01xxenv.primary_access_key]
}

3. 优化权限配置（可选） #

如果订阅级权限同步延迟过高，可以在存储账户创建后，直接给服务主体添加存储账户级的Storage Blob Data Contributor权限，减少跨层级的权限同步时间，但会增加资源配置的复杂度。

内容的提问来源于stack exchange，提问作者Rorepio