PowerShell配置跨订阅Log Analytics Workspace诊断设置报错

问题现象 #

执行PowerShell脚本为Function App配置跨订阅的Log Analytics Workspace诊断设置时，抛出错误：

ERROR: Resource type '/microsoft.operationalinsights/workspace' is invalid for property'properties.workspaceId'. Expected types are 'microsoft.operationalinsights/workspaces.

手动硬编码Workspace ID时可成功完成配置，推测问题源于Workspace ID的构造逻辑。

相关脚本示例 #

PowerShell脚本 #

[CmdLetBinding()]
param(
    [string] $SubscriptionId,
    [string] $BusinessFunAppRGName,
    [string] $BusinessFunAppName,
    [string] $laWorkspaceRGName,
    [string] $laWorkspaceName,
    [string] $lawSubscriptionId
)

$ResourceId = "/subscriptions/$SubscriptionId/resourceGroups/$BusinessFunAppRGName/providers/Microsoft.Web/sites/$BusinessFunAppName"

$diagSettings = Get-AzDiagnosticSetting -ResourceId $ResourceId

if($diagSettings)
{
    Write-Host "Diagnostics Settings Found"
}
else
{
    Write-Host "Diagnostics Settings Not Found, Applying settings..."

    $metric = @()
    $log = @()
    $metric += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -Category AllMetrics
    $log += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category FunctionAppLogs

    New-AzDiagnosticSetting -Name "DiagnosticSettings" `
        -ResourceId $ResourceId `
        -Log $log -Metric $metric `
        -WorkspaceId "/subscriptions/$lawSubscriptionId/resourceGroups/$laWorkspaceRGName/providers/microsoft.operationalinsights/workspace/$laWorkspaceName" `

    Write-Host "Done"
}

Workflow文件片段 #

- name: 'Update diagnostics settings' 
      uses: azure/powershell@v1
      with:
          azPSVersion: "latest"
          inlineScript: |
            arm-templates/business-subscription-afna/update-diagnostics.ps1 `
              -SubscriptionId ${{ github.event.inputs.businessSubscriptionId }} `
              -BusinessFunAppRGName ${env:parameters.resourceGroup.value} `
              -BusinessFunAppName ${env:parameters.funcAppName.value} `
              -laWorkspaceRGName ${env:parameters.mgmtlaWorkspaceRGName.value} `
              -laWorkspaceName ${env:parameters.mgmtlaWorkspaceName.value} `
              -lawSubscriptionId ${env:parameters.mgmtlawSubscriptionId.value} 
          failOnStandardError: $true

解决方案 #

1. 修正资源类型拼写错误
   错误根源是手动拼接的Workspace ID中，资源类型写成了单数workspace，而Azure要求必须是复数workspaces。将脚本中-WorkspaceId参数里的路径部分从microsoft.operationalinsights/workspace改为microsoft.operationalinsights/workspaces即可。

2. 推荐通过命令获取正确Workspace ID
   为避免手动拼接路径出错，建议先切换到目标订阅，通过Get-AzOperationalInsightsWorkspace命令获取Workspace对象，再提取标准的ResourceId：

   # 切换至Log Analytics所在订阅
   Set-AzContext -Subscription $lawSubscriptionId
   # 获取Workspace对象
   $laWorkspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName $laWorkspaceRGName -Name $laWorkspaceName
   # 提取正确的Workspace ID
   $workspaceId = $laWorkspace.ResourceId
   

   之后在New-AzDiagnosticSetting中直接使用-WorkspaceId $workspaceId即可。

3. 确认跨订阅权限
   确保执行脚本的账号同时拥有Function App所在订阅和Log Analytics Workspace所在订阅的权限（至少需要Log Analytics的读取权限和Function App的诊断设置写入权限）。

内容的提问来源于stack exchange，提问作者Nolan1513