Terraform部署Azure App Service调用禁用公网的Function App遇权限问题

问题1：Function App部署要求子网委派 #

Function App部署到虚拟网络子网时，必须将目标子网委派给Microsoft.Web/serverFarms，这是Azure的强制规则——只有被委派的子网才能承载Function App的计算资源，否则会抛出Function is missing a delegation to "Microsoft.Web/serverFarms"错误。

问题2：私有端点无法创建在已委派子网 #

Azure私有端点（Private Endpoint）不能部署在已被委派给其他服务的子网内，因为委派子网会被对应服务独占管理，不允许其他服务的私有端点资源存在。你遇到的PrivateEndpointCreationNotAllowedAsSubnetIsDelegated错误，说明你试图将存储账号的私有端点部署到了已被委派的子网（错误信息指向default子网，大概率是你误将该子网也配置了Microsoft.Web/serverFarms委派）。

正确部署配置方案 #

1. 子网规划 #

• default子网：仅部署App Service，不要配置Microsoft.Web/serverFarms委派（如果App Service需要VNet集成，针对Standard SKU配置Microsoft.Web服务端点即可）。
• functions子网：专门部署Function App，配置Microsoft.Web/serverFarms委派，满足Function App的部署要求。
• private-endpoints子网：新增独立子网，专门用于部署所有私有端点（包括Function App、存储账号的私有端点），该子网不要配置任何服务委派，仅需确保启用私有端点网络策略（默认允许）。

2. Terraform关键配置示例 #

子网配置

resource "azurerm_subnet" "default" {
  name                 = "default"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.0.0/24"]

  # App Service VNet集成（Standard SKU用服务端点）
  service_endpoints = ["Microsoft.Web"]
}

resource "azurerm_subnet" "functions" {
  name                 = "functions"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/24"]

  # Function App必需的子网委派
  delegation {
    name = "webserverfarm"

    service_delegation {
      name    = "Microsoft.Web/serverFarms"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "azurerm_subnet" "private_endpoints" {
  name                 = "private-endpoints"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.2.0/24"]

  # 私有端点子网无需委派，确保网络策略允许私有端点
  private_endpoint_network_policies_enabled = true
}

Function App配置（禁用公网访问）

resource "azurerm_function_app" "main" {
  name                       = "my-function-app"
  resource_group_name        = azurerm_resource_group.main.name
  location                   = azurerm_resource_group.main.location
  app_service_plan_id        = azurerm_app_service_plan.function_plan.id
  storage_account_name       = azurerm_storage_account.main.name
  storage_account_access_key = azurerm_storage_account.main.primary_access_key

  # 禁用公网访问
  public_network_access_enabled = false

  # 部署到已委派的functions子网
  virtual_network_subnet_id = azurerm_subnet.functions.id
}

私有端点配置（存储账号+Function App）

# 存储账号私有端点，部署到独立的private-endpoints子网
resource "azurerm_private_endpoint" "storage" {
  name                = "my-storage-private-endpoint"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  subnet_id           = azurerm_subnet.private_endpoints.id

  private_service_connection {
    name                           = "storage-privateserviceconnection"
    private_connection_resource_id = azurerm_storage_account.main.id
    subresource_names              = ["blob", "queue"]
    is_manual_connection           = false
  }
}

# Function App私有端点，部署到private-endpoints子网，供App Service调用
resource "azurerm_private_endpoint" "function_app" {
  name                = "my-function-app-private-endpoint"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  subnet_id           = azurerm_subnet.private_endpoints.id

  private_service_connection {
    name                           = "function-app-privateserviceconnection"
    private_connection_resource_id = azurerm_function_app.main.id
    subresource_names              = ["sites"]
    is_manual_connection           = false
  }
}

3. 额外注意事项 #

• App Service访问Function App私有端点时，需确保default子网与private-endpoints子网之间路由正常（VNet内部默认互通，无需额外配置）。
• 存储账号私有端点部署后，需配置对应私有DNS区域（如privatelink.blob.core.windows.net、privatelink.queue.core.windows.net）并关联到VNet，确保Function App能通过私有DNS访问存储账号。

内容的提问来源于stack exchange，提问作者Andrew Duffy