使用Azure Bicep和Azure DevOps部署Event Grid命名空间与主题失败

我正尝试通过Azure DevOps流水线，使用Azure Bicep模板部署Event Grid Namespace和Event Grid Topic，目标是建立两者关联，使Event Grid接收的MQTT消息能转发至Topic。

当前Bicep配置 #

Event Grid Topic模块（grid/eventGridTopic.bicep） #

resource eventGridTopic 'Microsoft.EventGrid/topics@2022-06-15' = {
  name: 'eventGridTopic'
  location: location

  properties: {
    inputSchema: 'CloudEventSchemaV1_0'
  }
}

output id string = eventGridTopic.id

Event Grid Namespace模块（grid/eventGrid.bicep） #

resource eventGrid 'Microsoft.EventGrid/namespaces@2023-06-01-preview' = {
  name: 'eventGridNamespace'
  location: location

  sku: {
    name: 'Standard'
    capacity: 1
  }

  properties: {
    isZoneRedundant: true

    topicSpacesConfiguration: {
      state: 'Enabled'
      routeTopicResourceId: eventGridTopicId
      maximumSessionExpiryInHours: 1
      maximumClientSessionsPerAuthenticationName: 1
    }
  }
}

主部署文件 #

module eventGridTopic 'grid/eventGridTopic.bicep' = {
  scope: GridRG
  name: 'gridTopicDeployment'
  params: {
    location: 'westeurope'
    projectName: projectName
  }
}

module eventGrid 'grid/eventGrid.bicep' = {
  scope: GridRG
  name: 'gridDeployment'
  params: {
    location: location
    projectName: projectName
    eventGridTopicId: eventGridTopic.outputs.id
  }
  dependsOn: [
    eventGridTopic
  ]
}

部署错误信息 #

{
  "code": "DeploymentFailed",
  "target": "X",
  "message": "至少有一个资源部署操作失败。请列出部署操作以获取详细信息。",
  "details": [
    {
      "code": "InvalidRequest",
      "message": "在命名空间eventGridNamespace下发布事件到路由主题eventGridTopic时遇到权限不足的问题。"
    }
  ]
}

解决方案 #

这个错误是因为Event Grid Namespace没有权限向指定的Topic发布事件，需要给Namespace分配对应的权限：

1. 给Event Grid Namespace启用系统托管身份 #

修改Namespace的Bicep资源，添加identity配置：

resource eventGrid 'Microsoft.EventGrid/namespaces@2023-06-01-preview' = {
  name: 'eventGridNamespace'
  location: location
  // 启用系统分配的托管身份
  identity: {
    type: 'SystemAssigned'
  }

  sku: {
    name: 'Standard'
    capacity: 1
  }

  properties: {
    isZoneRedundant: true

    topicSpacesConfiguration: {
      state: 'Enabled'
      routeTopicResourceId: eventGridTopicId
      maximumSessionExpiryInHours: 1
      maximumClientSessionsPerAuthenticationName: 1
    }
  }
}

// 输出身份的主体ID，用于后续角色分配
output principalId string = eventGrid.identity.principalId

2. 给托管身份分配Event Grid Topic的发布权限 #

在主部署文件中添加角色分配资源，给Namespace的系统身份分配EventGrid Event Sender角色：

module eventGridTopic 'grid/eventGridTopic.bicep' = {
  scope: GridRG
  name: 'gridTopicDeployment'
  params: {
    location: 'westeurope'
    projectName: projectName
  }
}

module eventGrid 'grid/eventGrid.bicep' = {
  scope: GridRG
  name: 'gridDeployment'
  params: {
    location: location
    projectName: projectName
    eventGridTopicId: eventGridTopic.outputs.id
  }
  dependsOn: [
    eventGridTopic
  ]
}

// 给Namespace的系统身份分配Event Grid Topic的发布权限
resource eventGridNamespaceRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(eventGridTopic.outputs.id, eventGrid.outputs.principalId, 'EventGridEventSender')
  scope: eventGridTopic // 角色分配的作用域是Topic资源
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2b6f1a47-58d8-4b2d-83b9-d7b58893550c') // EventGrid Event Sender角色的固定ID
    principalId: eventGrid.outputs.principalId
    principalType: 'ServicePrincipal'
  }
}

说明 #

• EventGrid Event Sender角色的ID是固定的2b6f1a47-58d8-4b2d-83b9-d7b58893550c，可直接使用
• 角色分配作用域设置为Event Grid Topic，确保权限最小化
• 角色分配会自动依赖两个模块的部署，无需额外添加dependsOn

内容的提问来源于stack exchange，提问作者CUiD8pdQJh