[英]Terraform azure keyVault SetSecret - Forbidden Access denied
I tried to provision a Terraform keyvault secret defining the access policy as below. 我试图提供一个Terraform密钥库机密,定义了如下的访问策略。 But I get permission issues.
但是我遇到了权限问题。
resource "azurerm_key_vault" "keyvault1" {
name = "${local.key_vault_one_name}"
location = "${local.location_name}"
resource_group_name = "${azurerm_resource_group.keyvault.name}"
enabled_for_disk_encryption = false
enabled_for_template_deployment = true
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
sku {
name = "standard"
}
access_policy {
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
object_id = "${data.azurerm_client_config.current.service_principal_object_id}"
application_id = "${data.azurerm_client_config.current.client_id}"
key_permissions = [
"get","list","update","create","import","delete","recover","backup","restore"
]
secret_permissions = [
"get","list","delete","recover","backup","restore","set"
]
certificate_permissions = [
"get","list","update","create","import","delete","recover","backup","restore", "deleteissuers", "getissuers", "listissuers", "managecontacts", "manageissuers", "setissuers"
]
}
}
# Create Key Vault Secrets
resource "azurerm_key_vault_secret" "test1" {
name = "db-username"
value = "bmipimadmin"
//vault_uri = "${azurerm_key_vault.keyvault1.vault_uri}"
key_vault_id = "${azurerm_key_vault.keyvault1.id}"
}
I get the below error when trying to terraform apply even though the service principal has all the access required to play with Key Vault. 即使服务主体具有使用Key Vault所需的所有访问权限,尝试进行地形应用时,我仍收到以下错误。
1 error occurred: * azurerm_key_vault_secret.test1: 1 error occurred: * azurerm_key_vault_secret.test1: keyvault.BaseClient#SetSecret: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. 发生1个错误:* azurerm_key_vault_secret.test1:发生1个错误:* azurerm_key_vault_secret.test1:keyvault.BaseClient#SetSecret:响应请求失败:StatusCode = 403-原始错误:autorest / azure:服务返回了错误。 Status=403 Code="Forbidden" Message="Access denied" InnerError={"code":"AccessDenied"}
Status = 403代码=“禁止访问”消息=“访问被拒绝” InnerError = {“代码”:“ AccessDenied”}
I can reproduce your issue and you are missing comma ,
at the end of permissions. 我可以重现你的问题,你缺少逗号
,
在权限的结束。 In this case, you just need to specify tenant_id
and object_id
when you terraform apply though the service principal. 在这种情况下,通过服务主体进行
tenant_id
应用时,只需指定tenant_id
和object_id
。 At this before, the service principal should be granted RBAC role (like contributor role) about your Azure key vault resource. 在此之前,应为服务主体授予有关您的Azure密钥保管库资源的RBAC角色(如贡献者角色)。 See more details here .
在这里查看更多详细信息。
For example, this works for me, 例如,这对我有用
access_policy {
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
object_id = "${data.azurerm_client_config.current.service_principal_object_id}"
key_permissions = [
"get","list","update","create","import","delete","recover","backup","restore",
]
secret_permissions = [
"get","list","delete","recover","backup","restore","set",
]
certificate_permissions = [
"get","list","update","create","import","delete","recover","backup","restore", "deleteissuers", "getissuers", "listissuers", "managecontacts", "manageissuers", "setissuers",
]
}
Ref: https://www.terraform.io/docs/providers/azurerm/r/key_vault.html#access_policy 参考: https : //www.terraform.io/docs/providers/azurerm/r/key_vault.html#access_policy
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.