您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.
使用 SAS 令牌和 Azure PowerShell 部署专用 Resource Manager 模板Deploy private Resource Manager template with SAS token and Azure PowerShell
如果模板驻留在存储帐户中,可以限制对该模板的访问,并在部署过程中提供共享访问签名 (SAS) 令牌。When your template resides in a storage account, you can restrict access to the template and provide a shared access signature (SAS) token during deployment. 本主题介绍如何将 Azure PowerShell 与 Resource Manager 模板配合使用在部署过程中提供 SAS 令牌。This topic explains how to use Azure PowerShell with Resource Manager templates to provide a SAS token during deployment.
将专用模板添加到存储帐户Add private template to storage account
可以将模板添加到存储帐户,并在部署过程中使用 SAS 令牌链接到这些模板。You can add your templates to a storage account and link to them during deployment with a SAS token.
重要
通过执行以下步骤,只有帐户所有者可以访问包含模板的 blob。By following the steps below, the blob containing the template is accessible to only the account owner. 但是,如果为 blob 创建 SAS 令牌,则拥有该 URI 的任何人都可以访问 blob。However, when you create a SAS token for the blob, the blob is accessible to anyone with that URI. 如果其他用户截获了该 URI,则此用户可以访问该模板。If another user intercepts the URI, that user is able to access the template. 使用 SAS 令牌是限制对模板的访问的好方法,但不应直接在模板中包括密码等敏感数据。Using a SAS token is a good way of limiting access to your templates, but you should not include sensitive data like passwords directly in the template.
以下示例设置一个专用存储帐户容器并上传一个模板:The following example sets up a private storage account container and uploads a template:
# create a storage account for templates
New-AzureRmResourceGroup -Name ManageGroup -Location "South Central US"
New-AzureRmStorageAccount -ResourceGroupName ManageGroup -Name {your-unique-name} -Type Standard_LRS -Location "West US"
Set-AzureRmCurrentStorageAccount -ResourceGroupName ManageGroup -Name {your-unique-name}
# create a container and upload template
New-AzureStorageContainer -Name templates -Permission Off
Set-AzureStorageBlobContent -Container templates -File c:\MyTemplates\storage.json
在部署期间提供 SAS 令牌Provide SAS token during deployment
要在存储帐户中部署专用模板,请生成 SAS 令牌,并将其包括在模板的 URI 中。To deploy a private template in a storage account, generate a SAS token and include it in the URI for the template. 设置到期时间以允许足够的时间来完成部署。Set the expiry time to allow enough time to complete the deployment.
Set-AzureRmCurrentStorageAccount -ResourceGroupName ManageGroup -Name {your-unique-name}
# get the URI with the SAS token
$templateuri = New-AzureStorageBlobSASToken -Container templates -Blob storage.json -Permission r `
-ExpiryTime (Get-Date).AddHours(2.0) -FullUri
# provide URI with SAS token during deployment
New-AzureRmResourceGroup -Name ExampleGroup -Location "South Central US"
New-AzureRmResourceGroupDeployment -ResourceGroupName ExampleGroup -TemplateUri $templateuri
有关将 SAS 令牌与链接模板配合使用的示例,请参阅将已链接的模版与 Azure Resource Manager 配合使用。For an example of using a SAS token with linked templates, see Using linked templates with Azure Resource Manager.
后续步骤Next steps
- 有关部署模板的简介,请参阅使用 Resource Manager 模板和 Azure PowerShell 部署资源。For an introduction to deploying templates, see Deploy resources with Resource Manager templates and Azure PowerShell.
- 有关用于部署模板的完整示例脚本,请参阅部署 Resource Manager 模板脚本For a complete sample script that deploys a template, see Deploy Resource Manager template script
- 若要在模板中定义参数,请参阅创作模板。To define parameters in template, see Authoring templates.
- 有关企业可如何使用 Resource Manager 有效管理订阅的指南,请参阅 Azure 企业基架 - 出于合规目的监管订阅。For guidance on how enterprises can use Resource Manager to effectively manage subscriptions, see Azure enterprise scaffold - prescriptive subscription governance.