Bicep创建函数应用遇StorageAccountIsNotProvisioned错误的解决咨询

问题根源 #

你遇到的StorageAccountIsNotProvisioned错误，核心原因是函数应用模块中调用storageAccount.listKeys()属于预部署评估操作——Bicep会在发起函数应用部署请求前就尝试获取存储账户密钥，而dependsOn仅能保证存储账户的部署请求已发送，无法确保它完全就绪到可调用密钥的状态。Application Insights无报错是因为仅读取其静态属性，这类操作在资源创建完成后即可执行，依赖关系能正常生效。

修复方案：通过模块输出传递就绪状态的连接字符串 #

通过存储账户模块输出预生成的连接字符串，而非在函数应用中主动调用密钥获取操作，利用模块输出的特性确保存储账户完全就绪后才传递连接信息。

1. 修改存储账户模块，添加连接字符串输出 #

param tags object
param storeAccountName string
param location string = resourceGroup().location
param skuName string = 'Standard_LRS' 

resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
  name: toLower(storeAccountName)
  kind: 'StorageV2'
  location : location
  sku: {
    name: skuName
  }
  tags: tags
}

// 输出预生成的存储账户连接字符串（会等待存储账户完全就绪后生成）
output connectionString string = 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${storageAccount.listKeys().keys[0].value}'
output accountName string = storageAccount.name

2. 修改函数应用模块，接收外部传递的连接字符串 #

移除模块内的存储账户现有资源引用，直接使用传入的连接字符串参数：

param tags object
param name string
param location string = resourceGroup().location
param appServicePlanId string
param applicationInsightsName string
param storageAccountConnectionString string // 新增：接收存储账户连接字符串

resource appInsights 'Microsoft.Insights/components@2020-02-02' existing = {
    name: applicationInsightsName
}

resource appService 'Microsoft.Web/sites@2022-03-01' = {
    name: name
    location: location
    kind: 'functionapp'
    properties: {
        serverFarmId: appServicePlanId
        siteConfig: {
            appSettings: [
                {
                    name: 'AzureWebJobsStorage'    
                    value: storageAccountConnectionString // 直接使用传入的就绪连接字符串
                  }
                // 以下Application Insights配置保持不变
                {
                    name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
                    value: appInsights.properties.ConnectionString
                }
                {
                    name: 'APPINSIGHTS_INSTRUMENTATIONKEY'
                    value: appInsights.properties.InstrumentationKey
                }
                {
                    name: 'APPINSIGHTS_PROFILERFEATURE_VERSION'
                    value: '1.0.0'
                }
                {
                    name: 'APPINSIGHTS_SNAPSHOTFEATURE_VERSION'
                    value: '1.0.0'
                }
                {
                    name: 'ApplicationInsightsAgent_EXTENSION_VERSION'
                    value: '~2'
                }
                {
                    name: 'XDT_MicrosoftApplicationInsights_Java'
                    value: '1'
                }
                {
                    name: 'XDT_MicrosoftApplicationInsights_Mode'
                    value: 'recommended'
                }
                {
                    name: 'XDT_MicrosoftApplicationInsights_NodeJS'
                    value: '1'
                }
                {
                    name: 'InstrumentationEngine_EXTENSION_VERSION'
                    value: 'disabled'
                }
                {
                    name: 'SnapshotDebugger_EXTENSION_VERSION'
                    value: 'disabled'
                }
                {
                    name: 'XDT_MicrosoftApplicationInsights_BaseExtensions'
                    value: 'disabled'
                }
                {
                    name: 'XDT_MicrosoftApplicationInsights_PreemptSdk'
                    value: 'disabled'
                }
            ]
        }
    }
    dependsOn: [
        appInsights
    ]
    tags: tags
    identity: {
        type: 'SystemAssigned'
    }
}

output principalId string = appService.identity.principalId

3. 修改主Bicep文件，传递存储账户模块的输出 #

在函数应用模块参数中，传入存储账户模块生成的连接字符串：

param location string = resourceGroup().location
param storageAccountSKUName string = 'Standard_LRS'
param functionAppServiceSKUName string = 'Y1'
param logAnalyticsSKUName string = 'Standard'

var storageAccountName = 'mystorage'
var logAnalyticsWorkspaceName = 'mylogs'
var appInsightsName = 'myinsights'
var appServicePlanName = 'myappservice'
var appServiceReceiveHL7v2POIName = 'your-function-name' // 补全原代码缺失的变量
var tags = {...}

module storageAccount './modules/storage/StorageAccount.bicep' = {
  name:'storageAccount'
  params: {
    tags: tags
    location:location
    storeAccountName:storageAccountName
    skuName:storageAccountSKUName
  }
}

module logWorkspace './modules/loganalytics/LogWorkspace.bicep' = {
  name: 'logAnalyticsWorkspace'
  params: {
    name: logAnalyticsWorkspaceName
    tags: tags
    skuName: logAnalyticsSKUName
    location: location    
  }
}

module appInsights './modules/loganalytics/AppInsignts.bicep' = {
  name: 'appInsights'
  params: {
    name:appInsightsName
    tags: tags
    location:location    
    workspaceId:logWorkspace.outputs.resourceId
  }
}

module appServicePlan './modules/services/AppServicePlan.bicep' = {
    name: 'appServicePlan'
    params: {
        tags: tags
        name: appServicePlanName
        skuName: functionAppServiceSKUName
        location:location
    }
}

module appService './modules/services/AppServiceReceiver.bicep' = {
    name: 'appServiceReceiveHL7v2POI'
    params: {
        tags: tags
        name: appServiceReceiveHL7v2POIName
        location:location
        appServicePlanId: appServicePlan.outputs.resourceId // 修正原代码变量名错误
        applicationInsightsName:appInsightsName
        storageAccountConnectionString: storageAccount.outputs.connectionString // 传递就绪的连接字符串
    }
}

方案原理 #

模块输出会等待所属资源完全部署完成（预配状态为Succeeded）后才生成，因此通过存储账户模块输出连接字符串，能确保函数应用部署时拿到的是已就绪的存储账户信息，彻底避免提前调用密钥接口导致的错误。

内容的提问来源于stack exchange，提问作者Jeremy