用于工作区存储帐户的防火墙支持的 ARM 模板

本页提供 ARM 模板，以及有关支持工作区存储帐户防火墙所需字段的说明。工作区存储帐户的防火墙支持由 ARM 模板属性 storageAccountFirewall 控制，该属性必须设置为 Enabled。

对于某些工作区配置（例如启用符合性安全配置文件），可能需要自定义 ARM 模板。如果对 ARM 模板有疑问，请提交 Azure 支持工单。还可以使用 Terraform 管理工作区配置。请参阅 azurerm_databricks_workspace Terraform 提供程序和 compliance_security_profile_enabled 属性。

ARM 模板字段

下表列出了以下 ARM 模板的字段及其说明，这些字段用于对工作区存储帐户的防火墙支持。

字段	说明
订阅	要使用的 Azure 订阅。
资源组	要使用的资源组。这通常是 VNet 的资源组。
工作区名称	工作区的名称。如果使用现有工作区，则其必须与现有工作区名称完全匹配。
受管理资源组名称	工作区的受管理资源组。这会在表单中自动填充为默认名称。如果组织想要自定义受管理资源组名称，请进行更改。
存储帐户名称	托管资源组中的Azure工作区存储帐户。这会在表单中自动填充为默认名称。如果组织想要自定义受管理资源组名称，请进行更改。
工作区 VNet 网络 ID	VNet 的资源 ID。对于现有工作区，可以通过导航到Azure门户中的工作区来获取此内容。单击 “属性”。在“自定义虚拟网络 ID”下，单击“以 JSON 形式查看值”。复制 `value` 字段中的资源 ID。
自定义专用子网名称	VNet 的专用子网。对于现有工作区，可以通过导航到Azure门户中的工作区来获取此内容。单击 “属性”。在“自定义专用子网”下，单击“以 JSON 形式查看值”。复制 `value` 字段中的子网名称。
自定义公共子网名称	VNet 的公共子网。对于现有工作区，可以通过导航到Azure门户中的工作区来获取此内容。单击 “属性”。在“自定义公共子网”下，单击“以 JSON 形式查看值”。复制 `value` 字段中的子网名称。
位置	自动填充以匹配主区域字段的Azure区域的短名称。
访问连接器名称	对于典型部署，请不要修改此字段。 Azure Databricks创建新的访问连接器。
托管标识类型	对于典型部署，请不要修改此字段。
用户托管标识资源 ID	对于典型部署，请不要修改此字段。
存储帐户防火墙	指定是否为工作区存储帐户启用防火墙支持。
禁用公共 IP	此属性必须设置为 `true`。这可实现安全群集连接，工作区存储帐户的防火墙支持要求如此。
公用网络访问	通常设置为“已启用”。如果启用Private Link，请参阅 Azure Private Link 概念以了解要使用的设置。
所需 NSG 规则	通常设置为“所有规则”。如果启用Private Link，请参阅 Azure Private Link 概念以了解要使用的设置。
已启用客户管理的密钥	如果将客户管理的密钥用于托管服务或托管磁盘，请将此字段设置为 true。请参阅用于加密的客户管理的密钥。
客户管理的密钥类型	如果已启用客户管理的密钥，请为此工作区选择客户管理的密钥类型。选择“托管服务”、“托管磁盘”或“两者皆可”。
托管服务密钥保管库密钥ID	如果将客户管理的密钥用于托管服务，请指定密钥保管库密钥 ID。
托管磁盘密钥保管库密钥 ID	如果将客户管理的密钥用于托管磁盘，请指定密钥保管库密钥 ID。
托管磁盘自动轮换	如果将客户管理的密钥用于托管磁盘，请指定是否自动选取新的密钥版本。

用于工作区存储帐户防火墙支持的 ARM 模板

复制以下 ARM 模板，以便为工作区存储帐户启用或禁用防火墙支持。

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "String",
      "metadata": {
        "description": "The name of the Azure Databricks workspace to update."
      }
    },
    "location": {
      "defaultValue": "[resourceGroup().location]",
      "type": "String",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "managedResourceGroupName": {
      "defaultValue": "[format('databricks-rg-{0}-{1}', parameters('workspaceName'), uniqueString(parameters('workspaceName'), resourceGroup().id))]",
      "type": "String",
      "metadata": {
        "description": "The Managed Resource GroupName of the workspace. Do not change unless using a custom managed resource group name."
      }
    },
    "storageAccountName": {
      "defaultValue": "[concat('dbstorage', uniqueString(resourceGroup().id, subscription().id))]",
      "type": "String",
      "metadata": {
        "description": "Workspace storage account name. Do not change unless using a custom storage account name."
      }
    },
    "workspaceVnetResourceId": {
      "defaultValue": "Required Resource ID of the workspace VNet",
      "type": "String",
      "metadata": {
        "description": "The Resource ID of the injected VNet for the workspace"
      }
    },
    "workspacePrivateSubnetName": {
      "defaultValue": "private-subnet",
      "type": "String",
      "metadata": {
        "description": "The private subnet name for the workspace"
      }
    },
    "workspacePublicSubnetName": {
      "defaultValue": "public-subnet",
      "type": "String",
      "metadata": {
        "description": "The public subnet name for the workspace"
      }
    },
    "accessConnectorName": {
      "defaultValue": "[format('{0}-access-connector', parameters('workspaceName'))]",
      "type": "String",
      "metadata": {
        "description": "The access connector to create for the workspace"
      }
    },
    "ManagedIdentityType": {
      "defaultValue": "SystemAssigned",
      "allowedValues": ["SystemAssigned", "UserAssigned", "SystemAssigned,UserAssigned"],
      "type": "String",
      "metadata": {
        "description": "Access Connector Managed Identity Type"
      }
    },
    "userManagedIdentityResourceId": {
      "defaultValue": "Required For User Mananged Identity",
      "type": "String",
      "metadata": {
        "description": "The Resource Id of the User Managed Identity"
      }
    },
    "storageAccountFirewall": {
      "defaultValue": "Enabled",
      "allowedValues": ["Enabled", "Disabled"],
      "type": "String",
      "metadata": {
        "description": "Enable or Disable firewall support for workspace default storage feature"
      }
    },
    "disablePublicIp": {
      "defaultValue": true,
      "type": "Bool",
      "metadata": {
        "description": "Specifies whether to deploy Azure Databricks workspace with secure cluster connectivity (SCC) enabled or not (No Public IP)."
      }
    },
    "publicNetworkAccess": {
      "defaultValue": "Enabled",
      "allowedValues": ["Enabled", "Disabled"],
      "type": "String",
      "metadata": {
        "description": "Indicates whether public network access is allowed to the workspace with private endpoint - possible values are Enabled or Disabled."
      }
    },
    "requiredNsgRules": {
      "defaultValue": "AllRules",
      "allowedValues": ["AllRules", "NoAzureDatabricksRules"],
      "type": "String",
      "metadata": {
        "description": "Indicates whether to retain or remove the AzureDatabricks outbound NSG rule - possible values are AllRules, NoAzureDatabricksRules (private link)."
      }
    },
    "storageDoubleEncryption": {
      "defaultValue": false,
      "type": "Bool",
      "metadata": {
        "description": "Is double encryption for managed storage enabled ?"
      }
    },
    "customerManagedKeysEnabled": {
      "defaultValue": false,
      "type": "Bool",
      "metadata": {
        "description": "Is CMK for managed services enabled ?"
      }
    },
    "CustomerManagedKeyType": {
      "defaultValue": "ManagedServicesCMK",
      "allowedValues": ["ManagedServicesCMK", "ManagedDisksCMK", "BothCMK"],
      "type": "String",
      "metadata": {
        "description": "Selects the CMK types for this workspace, Managed Services and/or Disks, Workspace storage account is not enabled here"
      }
    },

    "ManagedSrvcKeyVaultKeyId": {
      "defaultValue": "https://kv-url/keys/keyname/version",
      "type": "String",
      "metadata": {
        "description": "The Key Vault Key ID"
      }
    },
    "ManagedDiskKeyVaultKeyId": {
      "defaultValue": "https://kv-url/keys/keyname/version",
      "type": "String",
      "metadata": {
        "description": "The Key Vault Key ID"
      }
    },
    "ManagedDiskAutoRotation": {
      "type": "bool",
      "defaultValue": false,
      "allowedValues": [true, false],
      "metadata": {
        "description": "Whether managed disk will pick up new key version automatically."
      }
    }
  },
  "variables": {
    "ApiVersion": "2024-05-01",
    "workspaceSku": "premium",
    "systemAssignedObject": {
      "type": "[parameters('ManagedIdentityType')]"
    },
    "userAssignedObject": {
      "type": "[parameters('ManagedIdentityType')]",
      "userAssignedIdentities": {
        "[parameters('userManagedIdentityResourceId')]": {}
      }
    },
    "ConnectorSystemAssigned": {
      "id": "[resourceId('Microsoft.Databricks/accessConnectors', parameters('accessConnectorName'))]",
      "identityType": "[parameters('ManagedIdentityType')]"
    },
    "connectorUserAssigned": {
      "id": "[resourceId('Microsoft.Databricks/accessConnectors', parameters('accessConnectorName'))]",
      "identityType": "[parameters('ManagedIdentityType')]",
      "userAssignedIdentityId": "[parameters('userManagedIdentityResourceId')]"
    },
    "managedSrvcFirst": "[split(parameters('ManagedSrvcKeyVaultKeyId'),'/keys/')]",
    "managedSrvcSecond": "[split(variables('managedSrvcFirst')[1],'/')]",
    "managedDiskFirst": "[split(parameters('ManagedDiskKeyVaultKeyId'),'/keys/')]",
    "managedDiskSecond": "[split(variables('managedDiskFirst')[1],'/')]",
    "ManagedServicesCMK": {
      "managedServices": {
        "keySource": "Microsoft.Keyvault",
        "keyVaultProperties": {
          "keyVaultUri": "[variables('managedSrvcFirst')[0]]",
          "keyName": "[variables('managedSrvcSecond')[0]]",
          "keyVersion": "[variables('managedSrvcSecond')[1]]"
        }
      }
    },
    "ManagedDisksCMK": {
      "managedDisk": {
        "keySource": "Microsoft.Keyvault",
        "keyVaultProperties": {
          "keyVaultUri": "[variables('managedDiskFirst')[0]]",
          "keyName": "[variables('managedDiskSecond')[0]]",
          "keyVersion": "[variables('managedDiskSecond')[1]]"
        },
        "rotationToLatestKeyVersionEnabled": "[parameters('ManagedDiskAutoRotation')]"
      }
    },
    "BothCMK": {
      "managedServices": {
        "keySource": "Microsoft.Keyvault",
        "keyVaultProperties": {
          "keyVaultUri": "[variables('managedSrvcFirst')[0]]",
          "keyName": "[variables('managedSrvcSecond')[0]]",
          "keyVersion": "[variables('managedSrvcSecond')[1]]"
        }
      },
      "managedDisk": {
        "keySource": "Microsoft.Keyvault",
        "keyVaultProperties": {
          "keyVaultUri": "[variables('managedDiskFirst')[0]]",
          "keyName": "[variables('managedDiskSecond')[0]]",
          "keyVersion": "[variables('managedDiskSecond')[1]]"
        },
        "rotationToLatestKeyVersionEnabled": "[parameters('ManagedDiskAutoRotation')]"
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.Databricks/accessConnectors",
      "apiVersion": "2023-05-01",
      "name": "[parameters('accessConnectorName')]",
      "location": "[parameters('location')]",
      "identity": "[if(equals(parameters('ManagedIdentityType'),'SystemAssigned'),variables('systemAssignedObject'),variables('userAssignedObject'))]",
      "properties": {}
    },
    {
      "type": "Microsoft.Databricks/workspaces",
      "apiVersion": "[variables('ApiVersion')]",
      "name": "[parameters('workspaceName')]",
      "location": "[parameters('location')]",
      "dependsOn": ["[resourceId('Microsoft.Databricks/accessConnectors', parameters('accessConnectorName'))]"],
      "sku": {
        "name": "[variables('workspaceSku')]"
      },
      "properties": {
        "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]",
        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
        "requiredNsgRules": "[parameters('requiredNsgRules')]",
        "accessConnector": "[if(equals(parameters('ManagedIdentityType'),'SystemAssigned'),variables('ConnectorSystemAssigned'),variables('connectorUserAssigned'))]",
        "defaultStorageFirewall": "[parameters('storageAccountFirewall')]",
        "parameters": {
          "customVirtualNetworkId": {
            "value": "[parameters('workspaceVnetResourceId')]"
          },
          "customPrivateSubnetName": {
            "value": "[parameters('workspacePrivateSubnetName')]"
          },
          "customPublicSubnetName": {
            "value": "[parameters('workspacePublicSubnetName')]"
          },
          "enableNoPublicIp": {
            "value": "[parameters('disablePublicIp')]"
          },
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "requireInfrastructureEncryption": {
            "value": "[parameters('storageDoubleEncryption')]"
          }
        }
      },
      "condition": "[not(parameters('customerManagedKeysEnabled'))]"
    },
    {
      "type": "Microsoft.Databricks/workspaces",
      "apiVersion": "[variables('ApiVersion')]",
      "name": "[parameters('workspaceName')]",
      "location": "[parameters('location')]",
      "dependsOn": ["[resourceId('Microsoft.Databricks/accessConnectors', parameters('accessConnectorName'))]"],
      "sku": {
        "name": "[variables('workspaceSku')]"
      },
      "properties": {
        "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]",
        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
        "requiredNsgRules": "[parameters('requiredNsgRules')]",
        "accessConnector": "[if(equals(parameters('ManagedIdentityType'),'SystemAssigned'),variables('ConnectorSystemAssigned'),variables('connectorUserAssigned'))]",
        "encryption": {
          "entities": "[variables(parameters('CustomerManagedKeyType'))]"
        },
        "defaultStorageFirewall": "[parameters('storageAccountFirewall')]",
        "parameters": {
          "customVirtualNetworkId": {
            "value": "[parameters('workspaceVnetResourceId')]"
          },
          "customPrivateSubnetName": {
            "value": "[parameters('workspacePrivateSubnetName')]"
          },
          "customPublicSubnetName": {
            "value": "[parameters('workspacePublicSubnetName')]"
          },
          "enableNoPublicIp": {
            "value": "[parameters('disablePublicIp')]"
          },
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "requireInfrastructureEncryption": {
            "value": "[parameters('storageDoubleEncryption')]"
          }
        }
      },
      "condition": "[parameters('customerManagedKeysEnabled')]"
    }
  ]
}

反馈

此页面是否有帮助？

Last updated on 2026-04-22

用于工作区存储帐户的防火墙支持的 ARM 模板

ARM 模板字段

用于工作区存储帐户防火墙支持的 ARM 模板

反馈

其他资源