ARM模板中跨资源组连接Synapse工作区与存储账户的语法方案

一、存储账户模板：输出正确的资源坐标 #

跨资源组引用资源时，不能直接使用名称，必须通过资源ID定位。先修改存储账户模板，输出存储账户和文件系统的完整资源ID，供Synapse模板调用：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "minLength": 3,
      "maxLength": 24
    },
    "fileSystemName": {
      "type": "string"
    },
    "storageResourceGroup": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-01-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_GRS"
      },
      "kind": "StorageV2",
      "properties": {
        "isHnsEnabled": true
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2023-01-01",
      "name": "[concat(parameters('storageAccountName'), '/default/', parameters('fileSystemName'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ]
    }
  ],
  "outputs": {
    "storageAccountId": {
      "type": "string",
      "value": "[resourceId(parameters('storageResourceGroup'), 'Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
    },
    "fileSystemId": {
      "type": "string",
      "value": "[concat(resourceId(parameters('storageResourceGroup'), 'Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '/blobServices/default/containers/', parameters('fileSystemName'))]"
    }
  }
}

二、Synapse工作区模板：正确引用跨组存储 #

修改dlsName和dlsFsName变量，从存储模板输出的资源ID中提取名称，避免硬编码同组资源的语法错误。以下是完整的Synapse模板示例：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "synapseWorkspaceName": {
      "type": "string"
    },
    "sqlAdminLogin": {
      "type": "string"
    },
    "sqlAdminPassword": {
      "type": "securestring"
    },
    "storageAccountId": {
      "type": "string"
    },
    "fileSystemId": {
      "type": "string"
    }
  },
  "variables": {
    // 从存储账户ID中提取账户名称
    "dlsName": "[split(parameters('storageAccountId'), '/')[8]]",
    // 从文件系统ID中提取文件系统名称
    "dlsFsName": "[split(parameters('fileSystemId'), '/')[12]]",
    "dlsAccountUrl": "[concat('https://', variables('dlsName'), '.dfs.core.windows.net')]"
  },
  "resources": [
    {
      "type": "Microsoft.Synapse/workspaces",
      "apiVersion": "2021-06-01",
      "name": "[parameters('synapseWorkspaceName')]",
      "location": "[resourceGroup().location]",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "defaultDataLakeStorage": {
          "accountUrl": "[variables('dlsAccountUrl')]",
          "filesystem": "[variables('dlsFsName')]",
          "resourceId": "[parameters('storageAccountId')]"
        },
        "sqlAdministratorLogin": "[parameters('sqlAdminLogin')]",
        "sqlAdministratorLoginPassword": "[parameters('sqlAdminPassword')]"
      },
      "dependsOn": []
    },
    // 给Synapse工作区分配存储账户的Blob数据 contributor权限
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceGroup().id, parameters('synapseWorkspaceName'), 'StorageBlobDataContributor')]",
      "properties": {
        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
        "principalId": "[reference(resourceId('Microsoft.Synapse/workspaces', parameters('synapseWorkspaceName')), '2021-06-01').identity.principalId]",
        "scope": "[parameters('storageAccountId')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Synapse/workspaces', parameters('synapseWorkspaceName'))]"
      ]
    }
  ]
}

部署说明 #

1. 先部署存储账户模板，获取storageAccountId和fileSystemId两个输出值
2. 部署Synapse模板时，将上述两个输出值作为参数传入即可

三、Terraform替代方案 #

若ARM模板引擎存在兼容性问题，可使用Terraform实现相同逻辑：

存储账户配置 #

# 存储资源组
resource "azurerm_resource_group" "storage_rg" {
  name     = "storage-resource-group"
  location = "eastus"
}

# 启用HNS的存储账户
resource "azurerm_storage_account" "dls" {
  name                     = "yourdlsaccount001"
  resource_group_name      = azurerm_resource_group.storage_rg.name
  location                 = azurerm_resource_group.storage_rg.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
  is_hns_enabled           = true
}

# 文件系统（容器）
resource "azurerm_storage_container" "fs" {
  name                  = "synapsefilesystem"
  storage_account_name  = azurerm_storage_account.dls.name
  container_access_type = "Private"
}

Synapse工作区配置 #

# Synapse资源组
resource "azurerm_resource_group" "synapse_rg" {
  name     = "synapse-resource-group"
  location = "eastus"
}

# Synapse工作区
resource "azurerm_synapse_workspace" "main" {
  name                                 = "your-synapse-workspace"
  resource_group_name                  = azurerm_resource_group.synapse_rg.name
  location                             = azurerm_resource_group.synapse_rg.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_container.fs.id
  sql_administrator_login              = "sqladminuser"
  sql_administrator_login_password     = "H@shPass123!"

  identity {
    type = "SystemAssigned"
  }
}

# 给Synapse分配存储Blob数据权限
resource "azurerm_role_assignment" "synapse_storage_access" {
  scope                = azurerm_storage_account.dls.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_synapse_workspace.main.identity[0].principal_id
}

内容的提问来源于stack exchange，提问作者CodeMed