Azure Bicep如何为专用终结点的网络接口创建诊断设置

要实现为专用终结点关联的网络接口配置诊断设置，核心是先引用专用终结点自动创建的网络接口资源，再为该接口绑定诊断规则。以下是修正后的完整Bicep代码：

param vnetResourceGroup = 'testRg'
param vnetName string = 'testvnet'
param subnetName string = 'testsnet'
param storageAccountName string = 'testst'
param loggingWorkspaceId string = '/subscriptions/xxx_subscription_id/resourcegroups/xxx_resource_group/providers/microsoft.operationalinsights/workspaces/xxx-applogs-workspace'

resource vnet 'Microsoft.Network/virtualNetworks@2021-05-01' existing = {
  scope: resourceGroup(vnetResourceGroup)
  name: vnetName
}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2022-07-01' existing = {
  parent: vnet
  name: subnetName
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2022-05-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_ZRS'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
    allowBlobPublicAccess: false
    publicNetworkAccess: 'Disabled'
    networkAcls: {
      bypass: 'AzureServices'
      defaultAction: 'Allow'
    }
  }
}

resource storagePrivateEndpoint 'Microsoft.Network/privateEndpoints@2022-07-01' = {
  name: '${storageAccount.name}-pe'
  location: location
  properties: {
    subnet: {
      id: subnet.id
    }
    privateLinkServiceConnections: [
      {
        name: '${storageAccount.name}-pe-link'
        properties: {
          privateLinkServiceId: storageAccount.id
          groupIds: [
            'blob'
          ]
        }
      }
    ]
  }
}

// 引用专用终结点自动生成的网络接口
resource peNetworkInterface 'Microsoft.Network/networkInterfaces@2022-07-01' existing = {
  id: storagePrivateEndpoint.properties.networkInterfaces[0].id
}

// 为网络接口创建诊断设置
resource peNiDiagnosticSetting 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: '${storageAccount.name}-pe-ni-logs'
  scope: peNetworkInterface
  properties: {
    workspaceId: loggingWorkspaceId
    metrics: [
      {
        category: 'AllMetrics'
        enabled: true
      }
    ]
    // 可选：启用网络接口日志类别，按需调整
    logs: [
      {
        category: 'NetworkSecurityGroupEvent'
        enabled: true
      },
      {
        category: 'NetworkSecurityGroupRuleCounter'
        enabled: true
      }
    ]
  }
}

关键实现说明 #

1. 引用自动创建的网络接口：专用终结点部署完成后，storagePrivateEndpoint.properties.networkInterfaces会返回其关联的网络接口ID列表（通常一个专用终结点对应一个网络接口），通过existing资源类型直接引用该ID对应的网络接口。
2. 绑定诊断设置：将诊断设置资源的scope属性指向上述引用的网络接口，确保诊断规则应用到正确的目标资源。
3. 可选配置：可根据需求添加网络接口的日志类别，比如网络安全组事件、规则计数器等。

内容的提问来源于stack exchange，提问作者Angie Xiong