通过Bicep部署带生命周期管理规则的Azure存储账户失败

尝试通过Bicep部署带有生命周期管理规则的Azure存储账户时，What-if操作显示将创建两个新规则，但实际部署执行失败。

错误信息 #

{
  "code": "DeploymentFailed",
  "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
  "details": [
    {
      "code": "HttpResourceNotFound",
      "message": "The request url https://management.azure.com/subscriptions/xxxxxxxxxxxxxxxx/resourcegroups/xxxxxxxxx/providers/Microsoft.Storage/storageAccounts/xxxxxxxxxxx/managementPolicies/Rule2?api-version=2022-09-01 is not found."
    },
    {
      "code": "HttpResourceNotFound",
      "message": "The request url https://management.azure.com/subscriptions/xxxxxxxxxxxxxxxx/resourcegroups/xxxxxxxxx/providers/Microsoft.Storage/storageAccounts/xxxxxxxxxxx/managementPolicies/Rule1?api-version=2022-09-01 is not found."
    }
  ]
}

原Bicep代码 #

resource blob_storage 'Microsoft.Storage/storageAccounts@2022-09-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: sku
  }
  kind: 'StorageV2'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    azureFilesIdentityBasedAuthentication: {
      directoryServiceOptions: 'None'
    }
    minimumTlsVersion: tlsVersion
    isHnsEnabled: true
    networkAcls: {
      bypass: 'AzureServices'
      virtualNetworkRules: [for subnet in subnetList: {
        id: subnet
        action: 'Allow'
        state: 'Succeeded'
      }]
      ipRules: []
      defaultAction: 'Deny'
    }
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Hot'
  }
}

resource default_blob 'Microsoft.Storage/storageAccounts/blobServices@2022-09-01' = {
  parent: blob_storage
  name: 'default'
  properties: {
    deleteRetentionPolicy: {
      enabled: true
      days: retentionDays
    }
  }
}

resource containers 'Microsoft.Storage/storageAccounts/blobServices/containers@2022-09-01' = [for containerName in containerList: {
  parent: default_blob
  name: containerName
}]

resource lifecycleRule 'Microsoft.Storage/storageAccounts/managementPolicies@2022-09-01' = [for lifecycleRule in lifecycleManagementRules: {
  name: '${lifecycleRule.ruleName}'
  parent: blob_storage
  properties: {
    policy: {
      rules: lifecycleRule
    }
  }
}]

参数配置 #

"lifecycleManagementRules": {
            "value": [
            {
              "ruleName": "Rule1",
              "enabled": true,
              "type": "Lifecycle",
              "definition": {
                "actions": {
                  "baseBlob": {
                    "delete": {
                      "daysAfterLastAccessTimeGreaterThan": 30
                    }
                  }
                },
                "filters": {
                  "blobTypes": [
                    "blockBlob",
                    "pageBlob"
                  ],
                  "prefixMatch": "logs/"
                }
              }
            },
            {
              "ruleName": "Rule2",
              "enabled": true,
              "type": "Lifecycle",
              "definition": {
                "actions": {
                  "baseBlob": {
                    "delete": {
                      "daysAfterLastAccessTimeGreaterThan": 60
                    }
                  }
                },
                "filters": {
                  "blobTypes": [
                    "blockBlob"
                  ],
                  "prefixMatch": "backups/"
                }
              }
            }
            ]
        }
    }

已尝试更换managementPolicies的不同Bicep API版本，并确认订阅ID、资源组名称和存储账户名称均正确。

解决方案 #

问题根源 #

Azure存储账户的managementPolicies是单一子资源（名称固定为default），所有生命周期规则必须定义在该资源的policy.rules数组中，不能为每个规则创建独立的managementPolicies资源。原代码试图创建多个名为Rule1、Rule2的managementPolicies资源，不符合Azure资源模型，导致404错误。

修改后的Bicep代码 #

替换原代码中的lifecycleRule资源部分为以下内容：

resource lifecyclePolicy 'Microsoft.Storage/storageAccounts/managementPolicies@2022-09-01' = {
  parent: blob_storage
  name: 'default'
  properties: {
    policy: {
      rules: lifecycleManagementRules
    }
  }
}

说明 #

• 将所有规则通过lifecycleManagementRules参数直接传入policy.rules数组，无需循环创建多个资源
• managementPolicies资源名称固定为default，这是Azure存储账户生命周期策略的唯一合法名称
• 修改后，What-if操作会显示更新单一的managementPolicies资源，包含两个规则，部署即可成功

内容的提问来源于stack exchange，提问作者Frozen Fox