下面是我的Bicep代码。我在尝试在创建存储账户时禁用SAS密钥，但在运行Bicep代码时，仍然启用“允许存储账户密钥访问”的设置。

参考：https://shakeeljuancalleghani.medium.com/mastering-azure-bicep-deploy-storage-account-containers-lifecycle-management-policies-and-56d130aae48b

@description('The name of the new Storage Account object.')
param blobStorageAccountName string

@description('The Azure region being deployed to.')
param location string

@description('The sku of the Storage Account. Defaults to Standard_LRS.')
param skuName string = 'Standard_LRS'

@description('Required tag for Application.')
param applicationTag string

@description('Required tag for Criticality.')
param criticalityTag string

@description('Required tag for responsible Department.')
param departmentTag string

@description('Required tag for environment being deployed into.')
param environmentTag string

@description('Required tag for individual owner.')
param ownerTag string

@description('Any additional tags that need to be added. Input object `key`:`value`.')
param tags object = {}

@description('Enable/Disable Hierarchical Namespace. Defaults to false')
param isHnsEnabled bool = true

@description('Access Tier of Blob Storage. Allowed values - Cool Hot Premium. Defaults to Hot')
param accessTier string = 'Hot'

@description('Managed identity principal /object ID')
param identity string


@description('Array of container names to be created alongside the storage account')
param containerNames array

@description('Minimum TLS version for the storage account')
param minimumTlsVersion string = 'TLS1_2'

@description('Key vault used for the customer managed key')
param keyvault string

@description('The JsonWebKeyType of the key to be created.')
@allowed([
  'EC'
  'EC-HSM'
  'RSA'
  'RSA-HSM'
])
param keyType string = 'RSA'

@description('Specifies the size of the RSA key.')
@allowed([
  2048
  3072
  4096
])
param rsaKeySize int = 3072

@description('Indicates if the key is active or not.')
param isKeyEnabled bool = true

@description('Specifies the duration after which the key should be rotated.')
@allowed([
  'P1M'
  'P6M'
  'P1Y'
  'P2Y'
])
param rotationTimeAfterCreate string = 'P1M'

@description('Specifies the expiration duration for the new key version.')
@allowed([
  'P3M'
  'P13M'
  'P25M'
])
param expiryTime string = 'P3M'

@description('Duration before key expiration to trigger a notification.')
@allowed([
  'P15D'
  'P30D'
  'P45D'
])
param notifyTimeBeforeExpiry string = 'P30D'

@description('The Storage Account Vnet Name')
param vnetName string = 'vnet-infdev-uks'

@description('The Storage Account PeP Vnet Resource Group')
param vnetRG string = 'rg-inf-dev-001'

@description('The Storage Account Vnet Subnet Name')
param subnetName string = 'DataServices-sn'


@description('The DNS zone subscription ID')
param dnsZoneSubscriptionId string = '247bd41a-4f1b-40ba-a662-288c7298fbba'

@description('The DNS zone Resource Group')
param dnsZoneRG string = 'rg-prod-services-mgmt-001'

@description('The Subscription for the storage account')
param storageAccountSubscription string = '1860929f-9f3a-4362-9720-e8b8fc1ee807'

@description('The Resource Group for the storage account')
param storageAccountRG string  = 'rg-inf-auto-dev-001'

@description('The Virtual Network subscription ID')
param vnetSubscription string = '1860929f-9f3a-4362-9720-e8b8fc1ee807'

@description('The Private Endpoint Suffix')
param pep_suffix string = 'blob'

@description('The Private Endpoint Suffic')
param pep_groupID string = 'blob'

@description('SMB protocol versions for Azure Files')
param smbVersions string = 'SMB3.1.1'

@description('SMB authentication methods')
@allowed([
  'Kerberos' 
  'NTLMv2' 
  'Kerberos,NTLMv2'
 ])
param smbAuthMethods string = 'Kerberos'

@description('Kerberos ticket encryption for SMB')
@allowed([ 
  'AES-256' 
  'RC4-HMAC' 
  'AES-256,RC4-HMAC' 
])
param smbKerberosTicketEncryption string = 'AES-256'

@description('SMB channel encryption (in-flight) for SMB')
@allowed([ 
  'AES-128-CCM' 
  'AES-128-GCM' 
  'AES-256-GCM' 
  'AES-128-CCM,AES-128-GCM' 
  'AES-128-GCM,AES-256-GCM' 
])
param smbChannelEncryption string = 'AES-256-GCM'

@description('Enable SMB Multichannel (optional)')
param smbMultichannelEnabled bool = false


var commonTags = {
  Application: applicationTag
  Criticality: criticalityTag
  Department: departmentTag
  Environment: environmentTag
  Owner: ownerTag
}
var appliedTags = union(commonTags, tags)


var cmk = 'cmk-stg-${blobStorageAccountName}'


/*
##########################################################
RESOURCE LOOKUPS
##########################################################
*/

resource key_vault_existing 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
  name: keyvault
}

resource blob_mi 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
  name: identity
}

resource keyVaultKey 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
  name: cmk
  parent: key_vault_existing
  properties: {
    kty: keyType
    keySize: rsaKeySize
    rotationPolicy: {
      lifetimeActions: [
        {
          trigger: {
            timeAfterCreate: rotationTimeAfterCreate
          }
          action: {
            type: 'Rotate'
          }
        }
        {
          trigger: {
            timeBeforeExpiry: notifyTimeBeforeExpiry
          }
          action: {
            type: 'Notify'
          }
        }
      ]
      attributes: {
        expiryTime: expiryTime
      }
    }
    attributes:{
      enabled: isKeyEnabled
    }
  }
}




resource blobStorageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: blobStorageAccountName
  location: location
  tags: appliedTags
  kind: 'StorageV2'
  sku: {
    name: skuName
  }
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${blob_mi.id}': {}
    } 
  }
  properties: {
    encryption: {
      identity: {
        userAssignedIdentity: blob_mi.id // use the user assigned identity
      }
      keySource: 'Microsoft.Keyvault'
      keyvaultproperties: {
        keyvaulturi: key_vault_existing.properties.vaultUri
        keyname: cmk
        keyversion: null // do not specify version for automatic rotation
      }
      services: {
        blob: {
          enabled: true
          keyType: 'Account'
        }
        file: {
          enabled: true
          keyType: 'Account'
        }
      }
    }

    allowSharedKeyAccess: false
    supportsHttpsTrafficOnly: true
    accessTier: accessTier
    publicNetworkAccess: 'Disabled'
    allowBlobPublicAccess: false
    minimumTlsVersion: minimumTlsVersion
    isHnsEnabled: isHnsEnabled

    networkAcls: {
      bypass: 'AzureServices'
      defaultAction: 'Deny'
    }

  }
  dependsOn: [keyVaultKey]
}


//smb ssecurity hardening

resource smdFileshareSettings 'Microsoft.Storage/storageAccounts/fileServices@2023-05-01'= {
  parent: blobStorageAccount
  name: 'default'
  properties: {
    protocolSettings: {
      smb: {

        authenticationMethods: smbAuthMethods
        channelEncryption: smbChannelEncryption
        kerberosTicketEncryption: smbKerberosTicketEncryption
        versions: smbVersions
      }
    }
    shareDeleteRetentionPolicy: {
      allowPermanentDelete: true
      days: 7
      enabled: true
    }
  }
}

resource blob 'Microsoft.Storage/storageAccounts/blobServices@2022-09-01' = {
  name: 'default'
  parent: blobStorageAccount
  properties: {
    cors: {
      corsRules: []
    }
    deleteRetentionPolicy: {
      enabled: true
      days: 7
    }
    containerDeleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}


// Create containers if specified
resource containers 'Microsoft.Storage/storageAccounts/blobServices/containers@2021-06-01' = [for containerName in containerNames: {
  parent: blob
  name: !empty(containerNames) ? '${toLower(containerName)}' : 'placeholder'
  properties: {
    publicAccess: 'None'
    metadata: {}
  }
}]



var privateStorageBlobDnsZoneName = 'privatelink.${pep_groupID}.${environment().suffixes.storage}'

var subnet = resourceId(vnetSubscription,vnetRG, 'Microsoft.Network/virtualNetworks/subnets', vnetName, subnetName)
var privateEndpointStorageBlobName = 'pep-${blobStorageAccountName}-${pep_suffix}-001'


// Private endpoint

resource privateEndpointStorageBlob 'Microsoft.Network/privateEndpoints@2021-05-01' = {
  name: privateEndpointStorageBlobName
  location: location
  properties: {
    subnet: {
      id: subnet
    }
    customNetworkInterfaceName: '${privateEndpointStorageBlobName}-nic'
    privateLinkServiceConnections: [
      {
        name: 'MyStorageBlobPrivateLinkConnection'
        properties: {
          privateLinkServiceId: resourceId(storageAccountSubscription,storageAccountRG,'Microsoft.Storage/storageAccounts', blobStorageAccountName)   //blobStorageAccount.id
          groupIds: [
            '${pep_groupID}'
          ]
        }
      }
    ]
  }
  tags: appliedTags
  dependsOn: [blobStorageAccount]

}



// Private DNS zone

resource privateDnsZone 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2020-11-01' = {
  parent: privateEndpointStorageBlob
  name: 'default'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: privateStorageBlobDnsZoneName
        properties: {
          privateDnsZoneId: resourceId(dnsZoneSubscriptionId, dnsZoneRG, 'Microsoft.Network/privateDnsZones', privateStorageBlobDnsZoneName)

        }
      }
    ]
  }
}

var storageEndpoint = 'https://${blobStorageAccountName}.blob.${environment().suffixes.storage}'


// output storageAccount_principal_id string = blobStorageAccount.identity.principalId
output storageAccount_managed_identity object  = blobStorageAccount.identity.userAssignedIdentities
output blobstorageAccount_id string =  blobStorageAccount.id
output storageEndpoint string = storageEndpoint

解决方案

从阅读 这里 得出的结论，特别是这一行：

存储账户的 AllowSharedKeyAccess 属性默认未设置，且在你明确设置之前不会返回值。当属性值为 null 或 true 时，存储账户允许使用共享密钥进行的请求。

这点，以及GitHub问题 这里 让人觉得在创建存储账户时，你不能设置 allowSharedKeyAccess，必须在之后显式设置，例如：

resource disableSharedKey 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: blobStorageAccountName
  properties: {
    allowSharedKeyAccess: false
  }
  dependsOn: [
    blobStorageAccount
  ]
}

希望这能帮到你。