如何创建带Gmail API连接的Logic App ARM模板并解决部署报错

你遇到的报错如下：

部署“la-send-mail-1_2”失败，共返回1条错误。状态信息：无法完成工作流“la-send-mail”的操作，因为其关联的“gmail”连接器连接无效，请重新授权连接后重试。（错误代码：GmailConnectorPolicyViolation）

你当前使用的ARM模板代码如下：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "logicAppName": {
      "type": "string",
      "defaultValue": "la-send-mail",
      "metadata": {
        "description": "Name of the Logic App."
      }
    },
    "logicAppLocation": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location of the Logic App."
      }
    },
    "gmail_name": {
      "type": "string",
      "defaultValue": "gmail"
    },
    "gmail_displayName": {
      "type": "string",
      "defaultValue": "roman.dovhanyk@gmail.com"
    }
  },
  "variables": {},
  "resources": [
    {
      "type": "Microsoft.Logic/workflows",
      "apiVersion": "2016-06-01",
      "name": "[parameters('logicAppName')]",
      "location": "[parameters('logicAppLocation')]",
      "dependsOn": [
        "[resourceId('Microsoft.Web/connections', parameters('gmail_name'))]"
      ],
      "properties": {
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "$connections": {
              "defaultValue": {},
              "type": "Object"
            }
          },
          "triggers": {
            "manual": {
              "type": "Request",
              "kind": "Http",
              "inputs": {
                "schema": {
                  "properties": {
                    "body": {
                      "type": "string"
                    },
                    "bodyHTML": {
                      "type": "string"
                    },
                    "ccAddress": {
                      "type": "string"
                    },
                    "color": {
                      "type": "string"
                    },
                    "datafactoryName": {
                      "type": "string"
                    },
                    "pipelineName": {
                      "type": "string"
                    },
                    "pipelineRunId": {
                      "type": "string"
                    },
                    "time": {
                      "type": "string"
                    },
                    "title": {
                      "type": "string"
                    },
                    "toAddress": {
                      "type": "string"
                    }
                  },
                  "type": "object"
                }
              }
            }
          },
          "actions": {
            "Initialize_variable": {
              "runAfter": {},
              "type": "InitializeVariable",
              "inputs": {
                "variables": [
                  {
                    "name": "HTMLBody",
                    "type": "string",
                    "value": "<div>\n<h1 style=\"Color:@{triggerBody()?['color']};\"> Executed successfully </h1>\n<hr/>\nData Factory Name: <b>@{triggerBody()?['datafactoryName']}</b><br/>\nPipeline Name: <b>@{triggerBody()?['pipelineName']}</b><br/>\nPipeline Run Id<b>@{triggerBody()?['pipelineRunId']}</b><br/>\nTime: <b>@{triggerBody()?['time']}</b><br/>\n<hr/>\n<p>@{triggerBody()?['body']}</p>\n<div>@{triggerBody()?['bodyHTML']}</div>\n</div>"
                  }
                ]
              }
            },
            "Send_email_(V2)": {
              "runAfter": {
                "Initialize_variable": [
                  "Succeeded"
                ]
              },
              "type": "ApiConnection",
              "inputs": {
                "body": {
                  "Body": "<p>@{variables('HTMLBody')}</p>",
                  "Cc": "@triggerBody()?['ccAddress']",
                  "Subject": "@triggerBody()?['title']",
                  "To": "@triggerBody()?['toAddress']"
                },
                "host": {
                  "connection": {
                    "name": "@parameters('$connections')['gmail']['connectionId']"
                  }
                },
                "method": "post",
                "path": "/v2/Mail"
              }
            }
          },
          "outputs": {}
        },
        "parameters": {
          "$connections": {
            "value": {
              "gmail": {
                "id": "[concat('/subscriptions/',subscription().subscriptionId,'/providers/Microsoft.Web/locations/',parameters('logicAppLocation'),'/managedApis/gmail')]",
                "connectionId": "[resourceId('Microsoft.Web/connections', parameters('gmail_name'))]",
                "connectionName": "[parameters('gmail_name')]"
              }
            }
          }
        }
      }
    },
    {
      "type": "Microsoft.Web/connections",
      "apiVersion": "2016-06-01",
      "location": "[parameters('logicAppLocation')]",
      "name": "[parameters('gmail_name')]",
      "properties": {
        "api": {
          "id": "[concat('/subscriptions/',subscription().subscriptionId,'/providers/Microsoft.Web/locations/',parameters('logicAppLocation'),'/managedApis/gmail')]"
        },
        "displayName": "[parameters('gmail_displayName')]"
      }
    }
  ],
  "outputs": {}
}

报错根因 #

ARM模板仅能创建Gmail连接器的基础资源，无法自动完成Gmail账号的OAuth2.0授权流程，Google的API安全政策也禁止非验证应用通过脚本方式自动完成授权，因此部署后连接器处于未激活的无效状态。

修复步骤 #

1. 完成基础资源部署 #

无需修改现有ARM模板，忽略部署阶段的授权报错，先将Logic App和Gmail连接器资源部署到Azure资源组中。

2. 手动激活Gmail连接器 #

• 进入Azure门户，找到已部署的API连接类型的Gmail连接器资源，默认名称为gmail
• 进入连接器的编辑API连接页面，点击授权按钮
• 在弹出的Google登录窗口中，登录需要绑定的Gmail账号，完成授权后点击保存

若登录时出现「应用未验证」的拦截提示，需先完成Google侧的配置：

• 打开Google Cloud控制台，创建项目并启用Gmail API
• 配置OAuth同意屏幕，将使用的Gmail账号添加为测试用户，或提交应用完成公开验证

3. 验证Logic App可用性 #

• 打开Logic App设计器，确认Gmail发送邮件动作的连接器状态显示为「已连接」
• 手动触发测试运行，确认邮件可以正常发送

自动化部署优化（可选） #

如果需要避免每次部署都手动授权，可以采用以下方案：

• 预先完成一个Gmail连接器的授权，后续部署Logic App时直接引用该连接器的资源ID，不再重复创建新的Gmail连接器
• 改用SMTP连接器对接Gmail，使用Gmail应用密码进行身份验证，将密码存储在Azure Key Vault中，ARM部署时直接引用Key Vault密钥，无需手动授权

内容的提问来源于stack exchange，提问作者Kraken194