azure-devopsazure-resource-managerazure-data-lakeazure-data-lake-gen2

ARM template not able to run in ADO pipeline

I am trying to create a ADLS using ARM template in ADO pipeline, but im failing to do so. I was able to create the ADLS storage manually. There is a policy restricting the creation of storage, the error suggests that public access to storage should be disabled. I already added that part, im not sure whats failing.

storage.json

    {
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "parameters": {
            "storageAccountName": {
                "type": "string"
            },
            "containerName": {
                "type": "string"
            },
            "location": {
                "type": "string",
                "defaultValue": "westus2"
            },
            "resourceGroupName": {
                "type": "string"
            }
        },
        "resources": [
            {
                "type": "Microsoft.Storage/storageAccounts",
                "apiVersion": "2021-09-01",
                "name": "[parameters('storageAccountName')]",
                "location": "[parameters('location')]",
                "kind": "StorageV2",
                "sku": {
                    "name": "Standard_LRS"
                },
                "properties": {
                    "accessTier": "Hot",
                    "publicNetworkAccess": "Disabled",
                    "isHnsEnabled": true
                }
            },
            {
                "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
                "apiVersion": "2021-04-01",
                "name": "[concat(parameters('storageAccountName'), '/default/', parameters('containerName'))]",
                "dependsOn": [
                    "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
                ],
                "properties": {
                    "publicAccess": "None"
                }
            }
        ]
    }

parameters.json

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "storageAccountName": {
          "value": "adlscrscrs"
        },
        "containerName": {
          "value": "test"
        },
        "location": {
          "value": "eastus"
        },
        "resourceGroupName": {
          "value": "**"
        }
      }
    }

Error while creation

There were errors in your deployment. Error code: InvalidTemplateDeployment.
2025-03-05T16:21:23.9969916Z ##[error]The template deployment failed because of policy violation. Please see details for more information.
2025-03-05T16:21:23.9983670Z ##[error]Details:
2025-03-05T16:21:23.9985377Z ##[error]Resource 'adlscrscrs' was disallowed by policy. Error Type: PolicyViolation, Policy Definition Name : Blob public network access should be disabled for the Storage Account, Policy Assignment Name : **.
2025-03-05T16:21:23.9988639Z ##[error][More information on Azure Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/EditAssignmentBlade/id/%2Fproviders%2FMicrosoft.Management%2FmanagementGroups%2Fspgi%2Fproviders%2FMicrosoft.Authorization%2FpolicyAssignments%**)
2025-03-05T16:21:23.9990493Z ##[warning]Validation errors were found in the Azure Resource Manager template. This can potentially cause template deployment to fail. Task failed while creating or updating the template deployment.. Please follow https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-syntax
Solution

  • Based on the error message, you should set to disallow public access to all blobs on the Storage Account level.

    Resource 'xxxx' was disallowed by policy. Error Type: PolicyViolation, Policy Definition Name : Blob public network access should be disabled for the Storage Account, Policy Assignment Name : xxxx.

    In Microsoft.Storage/storageAccounts 2021-09-01, there is a properties parameter 'allowBlobPublicAccess' can be used to set to allow or disallow public access to all blobs or containers in the storage account. The default value is true for this parameter if you do not explicitly set it in the template.

    enter image description here

    For your case, you can set the property "allowBlobPublicAccess": false in the template storage.json.

    {
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        . . .
    },
    "resources": [
        {
            "type": "Microsoft.Storage/storageAccounts",
            . . .
            "properties": {
                "accessTier": "Hot",
                "publicNetworkAccess": "Disabled",  // Disallow public network access to Storage Account.
                "allowBlobPublicAccess": false,  // Disallow public access to all blobs or containers in the storage account.
                "isHnsEnabled": true
            }
        },
        {
            "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
            . . .
        }
    ]
}