使用Terraform关联Synapse工作区与存储容器时遇权限问题

部署Synapse Workspace成功后，在Synapse Studio中测试与WorkSpaceDefaultStorage的连接时，收到如下权限错误：

ADLS Gen2 operation failed for: Storage operation '' on container 'testconnection' get failed with 'Operation returned an invalid status code 'Forbidden''.

问题原因 #

Synapse工作区的系统分配身份未获得ADLS Gen2存储账户的必要访问权限。默认部署流程不会自动为Synapse的系统身份授予存储资源的访问权限，需手动配置角色分配。

Terraform解决方案 #

通过添加azurerm_role_assignment资源，为Synapse工作区的系统身份分配Storage Blob Data Contributor角色（该角色拥有足够的ADLS Gen2读写权限）。

完整修改后的代码

在现有Terraform代码中添加角色分配资源：

resource "azurerm_storage_account" "sa" {
  name                     = var.storage_account_name
  location                 = azurerm_resource_group.rg.location
  resource_group_name      = azurerm_resource_group.rg.name
  account_tier             = "Standard"
  account_replication_type = "GRS"
  account_kind             = "StorageV2"
  is_hns_enabled           = true
}

resource "azurerm_storage_data_lake_gen2_filesystem" "adlfs" {
  name               = var.azure_data_lake_name
  storage_account_id = azurerm_storage_account.sa.id
}

resource "azurerm_synapse_workspace" "synapseworkspace" {
  name                                 = var.synapse_workspace_name
  resource_group_name                  = azurerm_resource_group.rg.name
  location                             = azurerm_resource_group.rg.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.adlfs.id
  sql_administrator_login              = var.synapse_sql_admin_user
  sql_administrator_login_password     = var.synapse_sql_admin_password

  managed_resource_group_name = var.synapse_managed_resource_group_name

  aad_admin {
    login     = var.azure_ad_admin_login
    object_id = data.azurerm_client_config.current.object_id
    tenant_id = data.azurerm_client_config.current.tenant_id
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    source = "terraform"
  }
}

# 新增：为Synapse系统身份分配存储Blob数据贡献者角色
resource "azurerm_role_assignment" "synapse_storage_contributor" {
  scope                = azurerm_storage_account.sa.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_synapse_workspace.synapseworkspace.identity[0].principal_id
}

resource "azurerm_synapse_firewall_rule" "synapsefirewall" {
  name                 = "AllowAll"
  synapse_workspace_id = azurerm_synapse_workspace.synapseworkspace.id
  start_ip_address     = "0.0.0.0"
  end_ip_address       = "255.255.255.255"
}

说明

• scope指定权限作用范围：示例中作用于整个存储账户，若遵循最小权限原则，可改为azurerm_storage_data_lake_gen2_filesystem.adlfs.id，仅对指定文件系统授权。
• 角色分配生效需要几分钟时间，部署完成后等待片刻再测试连接即可。

内容的提问来源于stack exchange，提问作者Samuel