在Azure登陆区Corp管理组部署关联安全存储账户的Logic App

核心配置要求 #

要满足Corp管理组的强制策略，必须做到三点：

• Logic App完全禁用公网访问（而非“选定网络”）
• 关联的存储账户同步禁用公网访问，且Logic App通过私有端点+托管标识访问存储账户
• 所有配置在Terraform中一次性声明完成，避免先创建再修改导致的状态冲突

完整Terraform代码示例 #

# 1. 配置资源组（需位于Corp管理组对应的订阅下）
resource "azurerm_resource_group" "corp_logicapp_rg" {
  name     = "rg-corp-logicapp-demo"
  location = "eastus"
}

# 2. 配置虚拟网络和子网（用于私有端点部署）
resource "azurerm_virtual_network" "corp_vnet" {
  name                = "vnet-corp-logicapp-demo"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.corp_logicapp_rg.location
  resource_group_name = azurerm_resource_group.corp_logicapp_rg.name
}

resource "azurerm_subnet" "private_endpoint_subnet" {
  name                 = "snet-private-endpoints"
  resource_group_name  = azurerm_resource_group.corp_logicapp_rg.name
  virtual_network_name = azurerm_virtual_network.corp_vnet.name
  address_prefixes     = ["10.0.1.0/24"]

  # 必须禁用子网的私有端点网络策略
  private_endpoint_network_policies_enabled = false
}

# 3. 配置安全存储账户（完全禁用公网访问）
resource "azurerm_storage_account" "logicapp_storage" {
  name                     = "stcorpLogicappDemo" # 需全局唯一
  resource_group_name      = azurerm_resource_group.corp_logicapp_rg.name
  location                 = azurerm_resource_group.corp_logicapp_rg.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
  allow_blob_public_access = false
  # 核心配置：完全禁用公网访问
  public_network_access_enabled = false

  # 启用Blob存储（Logic App消耗型依赖）
  blob_properties {
    container_delete_retention_policy {
      days = 7
    }
  }
}

# 4. 配置存储账户的私有端点
resource "azurerm_private_endpoint" "storage_pe" {
  name                = "pe-storage-logicapp"
  resource_group_name = azurerm_resource_group.corp_logicapp_rg.name
  location            = azurerm_resource_group.corp_logicapp_rg.location
  subnet_id           = azurerm_subnet.private_endpoint_subnet.id

  private_service_connection {
    name                           = "psc-storage-logicapp"
    private_connection_resource_id = azurerm_storage_account.logicapp_storage.id
    subresource_names              = ["blob"]
    is_manual_connection           = false
  }
}

# 5. 配置私有DNS区域（解析存储账户私有端点）
resource "azurerm_private_dns_zone" "storage_blob_zone" {
  name                = "privatelink.blob.core.windows.net"
  resource_group_name = azurerm_resource_group.corp_logicapp_rg.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "storage_blob_link" {
  name                  = "vnet-link-storage-blob"
  resource_group_name   = azurerm_resource_group.corp_logicapp_rg.name
  private_dns_zone_name = azurerm_private_dns_zone.storage_blob_zone.name
  virtual_network_id    = azurerm_virtual_network.corp_vnet.id
}

# 6. 配置Logic App（消耗型，完全禁用公网访问）
resource "azurerm_logic_app_workflow" "corp_workflow" {
  name                = "logicapp-corp-demo-workflow"
  location            = azurerm_resource_group.corp_logicapp_rg.location
  resource_group_name = azurerm_resource_group.corp_logicapp_rg.name

  # 核心配置：完全禁用公网访问
  public_network_access_enabled = false

  # 启用系统托管标识，用于访问存储账户
  identity {
    type = "SystemAssigned"
  }

  # 关联存储账户（通过托管标识授权，无需连接字符串）
  storage_account {
    id = azurerm_storage_account.logicapp_storage.id
  }
}

# 7. 给Logic App托管标识分配存储账户Blob数据权限
resource "azurerm_role_assignment" "logicapp_storage_access" {
  scope                = azurerm_storage_account.logicapp_storage.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_logic_app_workflow.corp_workflow.identity[0].principal_id
}

关键配置说明 #

• 公网访问禁用：通过public_network_access_enabled = false实现完全禁用，这是满足策略的核心，区别于教程中常用的“选定网络”配置
• Terraform声明式配置：所有属性在资源定义阶段一次性设置，避免后续修改导致的状态不一致问题
• 私有端点与DNS解析：存储账户禁用公网后，必须通过私有端点访问，配套的私有DNS区域确保Logic App能正确解析存储账户的私有IP
• 托管标识授权：Logic App使用系统托管标识访问存储账户，无需暴露连接字符串，同时确保在私有网络环境下的权限验证

内容的提问来源于stack exchange，提问作者Matt S.