Terraform创建Premium级Azure存储账户时Private Endpoint部署失败求助

环境信息 #

• Terraform版本：v1.2.0（版本约束~> 1.2），运行环境linux_amd64
• AzureRM Provider版本：v3.60.0
• 存储账户配置：Premium_LRS、StorageV2类型

部署代码 #

Terraform私有端点资源代码 #

resource "azurerm_private_endpoint" "staccount-endpoint" {
  count = var.create_private_endpoint ? 1 : 0

  name                = var.privatelink_name
  location            = var.rg_location
  resource_group_name = var.sa_rg
  subnet_id           = data.azurerm_subnet.sa_subnet.id

  private_service_connection {
    name                           = format("%s-connection", var.privatelink_name)
    private_connection_resource_id = azurerm_storage_account.storage_account.id
    subresource_names              = ["file"]
    is_manual_connection           = false
  }

  tags = var.tags
}

对应的tfvar配置 #

privatelink_name = "my-pe"

allowed_subnets      = ["xxxxxxxxxxxxxxxx"]

sa_account_tier      = "Premium"
sa_replication_type  = "LRS"
sa_account_kind      = "StorageV2"
sa_access_tier       = "Hot"
sa_tls_version        = "TLS1_2"

错误详情 #

部署时触发400错误：

Error: creating Private Endpoint "my-pe" (Resource Group "my-rg"): network.PrivateEndpointsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidValuesForRequestParameters" Message="Call to Microsoft.Storage/storageAccounts failed. Error message: Values for request parameters are invalid: GroupId: file." Details=[]
│ 
│   with azurerm_private_endpoint.staccount-endpoint[0],
│   on main.tf line 23, in resource "azurerm_private_endpoint" "staccount-endpoint":
│   23: resource "azurerm_private_endpoint" "staccount-endpoint" {

问题原因 #

Azure存储账户的私有端点GroupId与账户层级/类型强相关：

• 标准层级（Standard）存储账户的文件服务对应GroupId为file
• Premium层级存储账户的文件服务对应GroupId为fileStorage

当前代码中使用了标准账户的GroupId值，与Premium账户不匹配，导致参数校验失败。

解决方案 #

修改私有端点资源中的subresource_names参数值为fileStorage，修正后的代码如下：

resource "azurerm_private_endpoint" "staccount-endpoint" {
  count = var.create_private_endpoint ? 1 : 0

  name                = var.privatelink_name
  location            = var.rg_location
  resource_group_name = var.sa_rg
  subnet_id           = data.azurerm_subnet.sa_subnet.id

  private_service_connection {
    name                           = format("%s-connection", var.privatelink_name)
    private_connection_resource_id = azurerm_storage_account.storage_account.id
    subresource_names              = ["fileStorage"] # 此处修改为正确的GroupId
    is_manual_connection           = false
  }

  tags = var.tags
}

重新执行terraform plan和terraform apply即可完成部署。

内容的提问来源于stack exchange，提问作者Vowneee