Azure 密钥保管库在 Python 中创建

Question

I am trying to programmatically create a key vault in python using this tutorial ( https://docs.microsoft.com/en-us/python/api/overview/azure/key-vault?view=azure-python ). No errors till the last step where it throws an exception when I call client.vaults.create_or_update() because I might not have used the right values for ALLOW_OBJECT_ID and ALLOW_TENANT_ID. The documentation says these values can be found on the portal but I could not find it, is there a way to get it programmatically?

Error: srest.exceptions.AuthenticationError: , AdalError: Get Token request returned http error: 400 and server response: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier XXX was not found in the directory YY

Code:

import subprocess
import json
from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.common.credentials import ServicePrincipalCredentials

def get_subscription():
    subs = json.loads(subprocess.check_output('az account list', 
                      shell=True).decode('utf-8'))
    subscription = subs[1]['id']
    cmd = 'az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/%s"' % subscription
    creds = json.loads(subprocess.check_output(cmd, shell=True).decode('utf-8'))
    return subscription, creds

def create_key_vault(vault_name='TestKeyVault'):
    subscription_id, creds = get_subscription()
    client_id = creds['appId']
    secret = creds['password']
    tenant = creds['tenant']
    credentials = ServicePrincipalCredentials(client_id=client_id, secret=secret, tenant=tenant)
    client = KeyVaultManagementClient(credentials, subscription_id)
    ALLOW_OBJECT_ID = client_id
    ALLOW_TENANT_ID = tenant

    RESOURCE_GROUP = 'SomeRG'
    VAULT_NAME = vault_name

    # Vault properties may also be created by using the 
    # azure.mgmt.keyvault.models.VaultCreateOrUpdateParameters
    # class, rather than a map.
    operation = client.vaults.create_or_update(
      RESOURCE_GROUP,
      VAULT_NAME,
      {
        'location': 'eastus',
        'properties': {
            'sku': {
                'name': 'standard'
            },
            'tenant_id': ALLOW_TENANT_ID,
            'access_policies': [{
                'object_id': ALLOW_OBJECT_ID,
                'tenant_id': ALLOW_TENANT_ID,
                'permissions': {
                    'keys': ['all'],
                    'secrets': ['all']
                }
            }]
        }
    }
)

    vault = operation.result()
    print(f'New vault URI: {vault.properties.vault_uri}')

Answer 1

Well, the objects could be the users, security groups, service principals in your Azure AD tenant, if you not familiar with access policy in keyvault, check this doc .

To get them grammatically, the easiest way in your case is to use Azure CLI in python.

Use az account show to get the tenantId .

Use az ad user list to get the objectId of the user.

Use az ad group list to get the objectId of the security group.

Use az ad sp list to get the objectId of the service principal.

Then you should specify the ALLOW_OBJECT_ID and ALLOW_TENANT_ID with the any objectId you need and tenantId above.