未从 ARM 模板正确生成 SAS 令牌中的 signedVersion

Question

我使用以下示例生成 SAS 并配置 App Service 以将 https 和应用程序日志发送到 blob。

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "storageAccountName": {
            "type": "string",
            "defaultValue": "[concat('storage', uniqueString(resourceGroup().id))]",
            "metadata": {
                "description": "The name of Storage Account."
            }
        },
        "blobContainerName": {
            "type": "string",
            "defaultValue": "[concat(parameters('webAppName'), '-logs')]",
            "metadata": {
                "description": "The name of Blob Container to store diagnostics logs from Web App."
            }
        },
        "storageAccountSkuName": {
            "type": "string",
            "defaultValue": "Standard_LRS",
            "metadata": {
                "description": "The name of the App Service Plan."
            }
        },
        "storageAccountKind": {
            "type": "string",
            "defaultValue": "StorageV2",
            "metadata": {
                "description": "The name of the Storage Account Type."
            }
        },
        "appServicePlanName": {
            "type": "string",
            "defaultValue": "[concat('appServicePlan', '-', uniqueString(resourceGroup().id))]",
            "metadata": {
                "description": "The name of the App Service Plan."
            }
        },
        "appServicePlanSkuName": {
            "type": "string",
            "defaultValue": "F1",
            "metadata": {
                "description": "The SKU name of the App Serivce Plan."
            }
        },
        "webAppName": {
            "type": "string",
            "defaultValue": "[concat('webApp', '-', uniqueString(resourceGroup().id))]",
            "metadata": {
                "description": "The name of the Web App."
            }
        },
        "diagnosticsLogsLevel": {
            "type": "string",
            "defaultValue": "Verbose",
            "allowedValues": [
                "Verbose",
                "Information",
                "Warning",
                "Error"
            ],
            "metadata": {
                "description": "The degree of severity for diagnostics logs."
            }
        },
        "diagnosticsLogsRetentionInDays": {
            "type": "int",
            "defaultValue": 10,
            "metadata": {
                "description": "Number of days for which the diagnostics logs will be retained."
            }
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]",
            "metadata": {
                "description": "Location for all resources."
            }
        }
    },
    "variables": {
        "blobContainerName": "[toLower(parameters('blobContainerName'))]",
        "listAccountSasRequestContent": {
            "signedServices": "bfqt",
            "signedPermission": "rwdlacup",
            "signedStart": "2018-10-01T00:00:00Z",
            "signedExpiry": "2218-10-30T00:00:00Z",
            "signedResourceTypes": "sco"
        }
    },
    "resources": [
        {
            "apiVersion": "2018-02-01",
            "type": "Microsoft.Storage/storageAccounts",
            "name": "[parameters('storageAccountName')]",
            "location": "[parameters('location')]",
            "sku": {
                "name": "[parameters('storageAccountSkuName')]"
            },
            "kind": "[parameters('storageAccountKind')]",
            "resources": [
                {
                    "name": "[concat('default/', variables('blobContainerName'))]",
                    "type": "blobServices/containers",
                    "apiVersion": "2018-02-01",
                    "dependsOn": [
                        "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]"
                    ],
                    "properties": {
                        "publicAccess": "Blob"
                    }
                }
            ]
        },
        {
            "apiVersion": "2018-02-01",
            "type": "Microsoft.Web/serverfarms",
            "name": "[parameters('appServicePlanName')]",
            "location": "[parameters('location')]",
            "sku": {
                "Name": "[parameters('appServicePlanSkuName')]"
            }
        },
        {
            "apiVersion": "2018-02-01",
            "type": "Microsoft.Web/sites",
            "name": "[parameters('webAppName')]",
            "location": "[parameters('location')]",
            "dependsOn": [
                "[concat('Microsoft.Web/serverfarms/', parameters('appServicePlanName'))]",
                "[concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))]"
            ],
            "properties": {
                "name": "[parameters('webAppName')]",
                "serverFarmId": "[concat('/subscriptions/', subscription().id,'/resourcegroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', parameters('appServicePlanName'))]"
            },
            "resources": [
                {
                    "apiVersion": "2018-02-01",
                    "type": "config",
                    "name": "logs",
                    "dependsOn": [
                        "[concat('Microsoft.Web/sites/', parameters('webAppName'))]"
                    ],
                    "properties": {
                        "applicationLogs": {
                            "azureBlobStorage": {
                                "level": "[parameters('diagnosticsLogsLevel')]",
                                "sasUrl": "[concat(reference(concat('Microsoft.Storage/storageAccounts/', parameters('storageAccountName'))).primaryEndpoints.blob, variables('blobContainerName'), '?', listAccountSas(parameters('storageAccountName'), '2018-02-01', variables('listAccountSasRequestContent')).accountSasToken)]",
                                "retentionInDays": "[parameters('diagnosticsLogsRetentionInDays')]"
                            }
                        }
                    }
                }
            ]
        }
    ]
}

当我尝试记录使用此 ARM 模板部署的 AppService 之一时，我看到以下错误消息：缺少有效共享访问签名的强制参数。

https://xxxstorage.blob.core.windows.net/httplogs?sv=2015-04-05&ss=bfqt&srt=sco&sp=rwdlacup&st=2018-01-01T00:00:00.0000000Z&se=2118-01-01T00:00:00.0000000Z&sig=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

此错误的根本原因是什么？

P.S 如果我从 Portal 或 Azure Storage Explorer 手动生成 SAS，我会看到 sv=2018-03-28，Portal 和 Azure Storage Explorer 中的 SAS 也有一个 sr=c 参数。

Answer 1

一位 Azure 团队工程师提供了工作代码。见下文。

 "variables": {
    "blobContainerName": "[toLower(parameters('blobContainerName'))]",
    "serviceSasProperties": {
        "canonicalizedResource": "[concat('/blob/', parameters('storageAccountName'),'/',parameters('blobContainerName'))]",
        "signedResource": "c",
        "signedPermission": "rwdl",
        "signedstart":"2017-08-20T11:00:00Z",
        "signedExpiry": "2020-08-20T11:00:00Z",
        "signedversion": "2015-04-05"
    }
},

"sasUrl": "[concat('https://',parameters('storageAccountName'),'.blob.core.windows.net/',parameters('blobContainerName'),'?',listServiceSas(parameters('storageAccountName'), '2018-07-01', variables('serviceSasProperties')).serviceSasToken)]",

Answer 2

您提供的 SAS URI 似乎不正确，它混合了帐户 SAS 和服务 SAS 的参数。这部分 https://xxxstorage.blob.core.windows.net/httplogs 看起来应该是一个服务 SAS URI，但它具有属于帐户 SAS 令牌参数的 ss=bfqt 和 srt=sco 参数。

更多详情，您可以参考这些链接。

• Parameters common to account SAS and service SAS tokens
• Parameters for a service SAS token
• Parameters for an account SAS token
• Examples of SAS URIs