1

我尝试使用 Azure 资源管理器和二头肌来部署 IoT 中心和存储帐户。IoT Hub 具有将所有消息存储在存储帐户中以进行归档的功能。IoT 中心应使用用户分配的托管标识访问存储帐户。

我想在一个用二头肌编写的 ARM 部署中部署所有这些东西。问题是使用用户分配的身份部署 IoT 中心并设置存档自定义路由。我得到错误：

{
    "code": "DeploymentFailed",
    "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
    "details": [
        {
            "code": "400140",
            "message": "endpointName:messageArchive, exceptionMessage:Invalid operation: Managed identity is not enabled for IotHub ... errorcode: IH400140."
        }
    ]
}

我的二头肌文件看起来像这样

resource messageArchive 'Microsoft.Storage/storageAccounts@2021-04-01' = {
  name: 'messagearchive4631'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_GRS'
  }
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
  }
}

resource messageArchiveBlobService 'Microsoft.Storage/storageAccounts/blobServices@2021-04-01' = {
  name: 'default'
  parent: messageArchive
  resource messageArchiveContainer 'containers@2021-02-01' = {
    name: 'iot-test-4631-container'
    properties: {
      publicAccess: 'None'
    }
  }
}

resource iotIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
  name: 'iot-test-access-archive-4631'  
  location: resourceGroup().location
}

resource iotAccesToStorage 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = {
  name: guid(extensionResourceId(messageArchive.id, messageArchive.type, 'iot-test-access-archive-4631'))
  scope: messageArchive
  properties: {
    roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe'
    principalId: iotIdentity.properties.principalId
    description: 'Allow acces for IoT Hub'
  }
}

resource iothub 'Microsoft.Devices/IotHubs@2021-03-31' = {
  name: 'iot-test-4631'
  location: resourceGroup().location
  sku: {
    name: 'B1'
    capacity: 1
  }
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities:{
      '${iotIdentity.id}': {}
    }
  }
  dependsOn:[
    iotAccesToStorage
  ]
  properties: {
    features: 'None'
    eventHubEndpoints: {
      events: {
        retentionTimeInDays: 1
        partitionCount: 4
      }
    }
    routing: {
      endpoints: {
        storageContainers: [
          {
            name: 'messageArchive'
            endpointUri: 'https://messagearchive4631.blob.core.windows.net/'
            containerName: 'iot-test-4631-container'
            batchFrequencyInSeconds: 100
            maxChunkSizeInBytes: 104857600
            encoding: 'Avro'
            fileNameFormat: '{iothub}/{YYYY}/{MM}/{DD}/{HH}/{mm}_{partition}.avro'
            authenticationType: 'identityBased'
          }
        ]
      }
      routes: [
        {
          name: 'EventHub'
          source: 'DeviceMessages'
          endpointNames: [
            'events'
          ]
          isEnabled: true
        }
        {
          name: 'messageArchiveRoute'
          source: 'DeviceMessages'
          endpointNames: [
            'messageArchive'
          ]
          isEnabled: true
        }
      ]
      fallbackRoute: {
        source: 'DeviceMessages'
        endpointNames: [
          'events'
        ]
        isEnabled: true
      }
    }
  }
}

我尝试删除 IoT Hub 中的消息路由块

endpoints: {
  storageContainers: [
    {
      name: 'messageArchive'
      endpointUri: 'https://messagearchive4631.blob.core.windows.net/'
      containerName: 'iot-test-4631-container'
      batchFrequencyInSeconds: 100
      maxChunkSizeInBytes: 104857600
      encoding: 'Avro'
      fileNameFormat: '{iothub}/{YYYY}/{MM}/{DD}/{HH}/{mm}_{partition}.avro'
      authenticationType: 'identityBased'
    }
  ]
}

并部署一次。此部署有效。如果我随后包含消息路由块并再次部署它，那么它会按预期工作。

是否可以在单个部署中执行此操作？

4

1 回答 1

0

我自己想通了。我正在使用用户分配的托管标识，因此在 IoT 中心端点存储容器配置中缺少此标识：

authenticationType: 'identityBased'
identity: {
   userAssignedIdentity: iotIdentity.id
}

完整的 IoT 中心端点配置如下所示

endpoints: {
  storageContainers: [
    {
      name: 'RawDataStore'
      endpointUri: 'https://${nameRawDataStore}.blob.${environment().suffixes.storage}/'
      containerName: nameIotHub
      batchFrequencyInSeconds: 100
      maxChunkSizeInBytes: 104857600
      encoding: 'Avro'
      fileNameFormat: '{iothub}/{YYYY}/{MM}/{DD}/{HH}/{mm}_{partition}.avro'
      authenticationType: 'identityBased'
      identity: {
        userAssignedIdentity: iotIdentity.id
      }
    }
  ]
}
于 2021-08-19T16:56:48.197 回答