驗證將事件擷取至 Azure 事件中樞目的地的模式

發行項
08/08/2024

Azure 事件中樞可讓您在將事件擷取至您選擇的 Azure Blob 儲存體或 Azure Data Lake Storage Gen 1 或 Gen 2 帳戶等目的地時，選取不同的驗證模式。驗證模式會決定在事件中樞中執行的擷取代理程式要如何與擷取目的地進行驗證。

使用受控識別

受控識別是使用 Microsoft Entra ID 型驗證和授權，從事件中樞無縫地存取擷取目的地的慣用方式。

顯示使用受控識別將事件中樞資料擷取到 Azure 儲存體或 Azure Data Lake Storage 的影像

您可以搭配事件中樞擷取目的地使用系統指派或使用者指派的受控識別。

使用系統指派的受控識別來擷取事件

系統指派的受控識別會自動建立，並與 Azure 資源相關聯，在此案例中為事件中樞命名空間。

若要使用系統指派的識別，擷取目的地必須針對對應的系統指派識別啟用必要的角色指派。然後，您可以在事件中樞啟用擷取功能時，選取 System Assigned 受控識別選項。

顯示使用系統指派的受控識別將事件中樞資料擷取到 Azure 儲存體或 Azure Data Lake Storage 的影像。

然後，擷取代理程式會使用命名空間的識別，與擷取目的地進行驗證和授權。

Azure Resource Manager 範本

以下是一個範例 Azure Resource Manager (ARM) 範本，用於使用系統指派的受控識別來設定資料擷取。

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "namespaces_eventhubcapture_name": {
            "defaultValue": "eventhubcapturens",
            "type": "String"
        },
        "captureEnabled": {
            "defaultValue": true,
            "type": "Bool",
            "metadata": {
                "description": "Enable or disable the Capture feature for your event hub."
            }
        },
        "captureEncodingFormat": {
            "defaultValue": "Avro",
            "allowedValues": [
                "Avro"
            ],
            "type": "String",
            "metadata": {
                "description": "The encoding format that Event Hubs Capture uses to serialize the event data when archiving to your storage."
            }
        },
        "captureTime": {
            "defaultValue": 300,
            "minValue": 60,
            "maxValue": 900,
            "type": "Int",
            "metadata": {
                "description": "the time window in seconds for the archival."
            }
        },
        "captureSize": {
            "defaultValue": 314572800,
            "minValue": 10485760,
            "maxValue": 524288000,
            "type": "Int",
            "metadata": {
                "description": "the size window in bytes for the capture."
            }
        },
        "blobContainerName": {
            "type": "String",
            "metadata": {
                "description": "Your existing storage container that you want the blobs archived in."
            }
        },
        "captureNameFormat": {
            "defaultValue": "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}",
            "type": "String",
            "metadata": {
                "description": "A Capture Name Format must contain {Namespace}, {EventHub}, {PartitionId}, {Year}, {Month}, {Day}, {Hour}, {Minute} and {Second} fields. These can be arranged in any order with or without delimiters. E.g.  Prod_{EventHub}/{Namespace}\\{PartitionId}_{Year}_{Month}/{Day}/{Hour}/{Minute}/{Second}"
            }
        },
		"existingStgSubId": {
            "type": "String",
            "metadata": {
                "description": "The ID of the Azure subscription that has your existing storage account."
            }
        },
		"existingStgAccRG": {
            "type": "String",
            "metadata": {
                "description": "The resource group that has the storage account."
            }
        },
        "existingStgAcctName": {
            "type": "String",
            "metadata": {
                "description": "The name of the storage account."
            }
        }
    },
    "variables": 
	{
		"roleAssignmentId": "[guid(resourceId('Microsoft.EventHub/namespaces/',parameters('namespaces_eventhubcapture_name')))]",
		"storageBlobDataOwnerId": "[concat(subscription().Id, '/providers/Microsoft.Authorization/roleDefinitions/', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
		"ehId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/', 'Microsoft.EventHub/namespaces/',parameters('namespaces_eventhubcapture_name')) ]",
		"existingStorageAcctResourceId" : "[concat('/subscriptions/', parameters('existingStgSubId'), '/resourceGroups/', parameters('existingStgAccRG'), '/providers/', 'Microsoft.Storage/storageAccounts/',parameters('existingStgAcctName')) ]"
	},
    "resources": [
        {
            "type": "Microsoft.EventHub/namespaces",
            "apiVersion": "2023-01-01-preview",
            "name": "[parameters('namespaces_eventhubcapture_name')]",
            "location": "eastus",
            "sku": {
                "name": "Standard",
                "tier": "Standard",
                "capacity": 1
            },
            "identity": {
                "type": "SystemAssigned"
            },
            "properties": {
                "minimumTlsVersion": "1.2",
                "publicNetworkAccess": "Enabled",
                "disableLocalAuth": false,
                "zoneRedundant": true,
                "isAutoInflateEnabled": false,
                "maximumThroughputUnits": 0,
                "kafkaEnabled": true
            }
        },
        {
            "type": "Microsoft.EventHub/namespaces/authorizationrules",
            "apiVersion": "2023-01-01-preview",
            "name": "[concat(parameters('namespaces_eventhubcapture_name'), '/RootManageSharedAccessKey')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
            ],
            "properties": {
                "rights": [
                    "Listen",
                    "Manage",
                    "Send"
                ]
            }
        },
		{
			"type": "Microsoft.Resources/deployments",
			"apiVersion": "2022-09-01",
			"name": "nestedStgTemplate",
			"subscriptionId": "[parameters('existingStgSubId')]",
			"resourceGroup": "[parameters('existingStgAccRG')]",
			"properties": {
				"expressionEvaluationOptions": {
					"scope": "outer"
				},
				"mode": "Incremental",
				"template": {
					"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
					"contentVersion": "1.0.0.0",
					"resources": [
						{
							"type": "Microsoft.Authorization/roleAssignments",
							"name": "C0F7F914-0FF9-47B2-9960-1D64D97FF594",
							"apiVersion": "2018-01-01-preview",
							"scope": "[variables('existingStorageAcctResourceId')]",
							"properties": {
								"roleDefinitionId": "[variables('storageBlobDataOwnerId')]",
								"principalId": "[reference(variables('ehId'), '2021-11-01', 'Full').identity.principalId]"
							}
						}
					]
				}
			}
		},
        {
            "type": "Microsoft.EventHub/namespaces/eventhubs",
            "apiVersion": "2023-01-01-preview",
            "name": "[concat(parameters('namespaces_eventhubcapture_name'), '/capture')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]",
				"nestedStgTemplate"
            ],
            "properties": {
                "retentionDescription": {
                    "cleanupPolicy": "Delete",
                    "retentionTimeInHours": 24
                },
                "messageRetentionInDays": 1,
                "partitionCount": 1,
                "status": "Active",
                "captureDescription": {
                    "enabled": "[parameters('captureEnabled')]",
                    "skipEmptyArchives": false,
                    "encoding": "[parameters('captureEncodingFormat')]",
                    "intervalInSeconds": "[parameters('captureTime')]",
                    "sizeLimitInBytes": "[parameters('captureSize')]",
                    "destination": {
                        "name": "EventHubArchive.AzureBlockBlob",
                        "properties": {
                            "storageAccountResourceId": "[variables('existingStorageAcctResourceId')]",
                            "blobContainer": "[parameters('blobContainerName')]",
                            "archiveNameFormat": "[parameters('captureNameFormat')]"
                        },
						"identity": {
							"type": "SystemAssigned"
						}
                    }
                }
            }
        },
        {
            "type": "Microsoft.EventHub/namespaces/networkRuleSets",
            "apiVersion": "2023-01-01-preview",
            "name": "[concat(parameters('namespaces_eventhubcapture_name'), '/default')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
            ],
            "properties": {
                "publicNetworkAccess": "Enabled",
                "defaultAction": "Allow",
                "virtualNetworkRules": [],
                "ipRules": []
            }
        },
        {
            "type": "Microsoft.EventHub/namespaces/eventhubs/consumergroups",
            "apiVersion": "2023-01-01-preview",
            "name": "[concat(parameters('namespaces_eventhubcapture_name'), '/capture/$Default')]",
            "location": "eastus",
            "dependsOn": [
                "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('namespaces_eventhubcapture_name'), 'capture')]",
                "[resourceId('Microsoft.EventHub/namespaces', parameters('namespaces_eventhubcapture_name'))]"
            ],
            "properties": {}
        }
    ]
}

Parameters.json:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "namespaces_eventhubcapture_name": {
            "value": "NAMESPACENAME"
        },
        "captureEnabled": {
            "value": true
        },
        "captureEncodingFormat": {
            "value": "Avro"
        },
        "captureTime": {
            "value": 300
        },
        "captureSize": {
            "value": 314572800
        },
        "blobContainerName": {
            "value": "BLOBCONTAINERNAME"
        },
        "captureNameFormat": {
            "value": "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
        },
		"existingStgSubId": {
            "value": "00000000-0000-0000-0000-00000000000000"
        },
		"existingStgAccRG": {
            "value": "STORAGERESOURCEGROUPNAME"
        },
		"existingStgAcctName": {
            "value": "STORAGEACCOUNTNAME"
        }
    }
}

使用使用者指派的受控識別來擷取事件

您可以建立使用者指派的受控識別，然後用來與事件中樞的擷取目的地進行驗證和授權。建立受控識別之後，便可將其指派給事件中樞命名空間，並確定擷取目的地已針對對應的使用者指派識別啟用必要的角色指派。

然後，您可以在事件中樞啟用擷取功能時，選取 User Assigned 受控識別選項，並在啟用擷取功能時指派必要的使用者指派識別。

顯示將事件中樞資料擷取至 Azure 儲存體或 Azure Data Lake Storage 的影像然後，擷取代理程式會使用已設定的使用者指派識別，與擷取目的地進行驗證和授權。

將事件擷取至不同訂用帳戶中的擷取目的地

事件中樞擷取功能也支援使用受控識別，將資料擷取至不同訂用帳戶中的擷取目的地。

重要

Azure 入口網站不支援選取不同訂用帳戶中的擷取目的地。為此，您必須使用 ARM 範本。

因此，使用 ARM 範本啟用擷取功能指南中所提供的 ARM 範本可以用來與對應的受控識別搭配使用。

例如，下列 ARM 範本可用來建立已啟用擷取的事件中樞。 Azure 儲存體或 Azure Data Lake Storage Gen 2 可用來作為擷取目的地，而使用者指派的識別則作為驗證方法。目的地的資源識別碼可以指向不同訂用帳戶中的資源。

"resources":[
      {
         "apiVersion":"[variables('ehVersion')]",
         "name":"[parameters('eventHubNamespaceName')]",
         "type":"Microsoft.EventHub/Namespaces",
         "location":"[variables('location')]",
         "sku":{
            "name":"Standard",
            "tier":"Standard"
         },
         "resources": [
    {
      "apiVersion": "2017-04-01",
      "name": "[parameters('eventHubNamespaceName')]",
      "type": "Microsoft.EventHub/Namespaces",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard"
      },
      "properties": {
        "isAutoInflateEnabled": "true",
        "maximumThroughputUnits": "7"
      },
      "resources": [
        {
          "apiVersion": "2017-04-01",
          "name": "[parameters('eventHubName')]",
          "type": "EventHubs",
          "dependsOn": [
            "[concat('Microsoft.EventHub/namespaces/', parameters('eventHubNamespaceName'))]"
          ],
          "properties": {
            "messageRetentionInDays": "[parameters('messageRetentionInDays')]",
            "partitionCount": "[parameters('partitionCount')]",
            "captureDescription": {
              "enabled": "true",
              "skipEmptyArchives": false,
              "encoding": "[parameters('captureEncodingFormat')]",
              "intervalInSeconds": "[parameters('captureTime')]",
              "sizeLimitInBytes": "[parameters('captureSize')]",
              "destination": {
                "name": "EventHubArchive.AzureBlockBlob",
                "properties": {
                  "storageAccountResourceId": "[parameters('destinationStorageAccountResourceId')]",
                  "blobContainer": "[parameters('blobContainerName')]",
                  "archiveNameFormat": "[parameters('captureNameFormat')]"
                },
               "identity": {
                 "type": "UserAssigned",
                 "userAssignedIdentities": {
                   "xxxxxxxx": {}
                  }
          						}
              }
            }
          }
        }
      ]
    }
  ]

深入了解此功能，以及如何使用 Azure 入口網站和 Azure Resource Manager 範本加以啟用：

共用方式為

驗證將事件擷取至 Azure 事件中樞目的地的模式

使用受控識別

使用系統指派的受控識別來擷取事件

Azure Resource Manager 範本

使用使用者指派的受控識別來擷取事件

將事件擷取至不同訂用帳戶中的擷取目的地

意見反應

其他資源

共用方式為

驗證將事件擷取至 Azure 事件中樞目的地的模式

使用受控識別

使用系統指派的受控識別來擷取事件

Azure Resource Manager 範本

使用使用者指派的受控識別來擷取事件

將事件擷取至不同訂用帳戶中的擷取目的地

相關內容

意見反應

其他資源