[英]Terraform grant azure function app with msi access to azure keyvault
我正在尝试使用Terraform在Azure中设置Terraform创建的场景:
- 具有托管服务标识的Azure功能应用程序
- Azure Key Vault
- 密钥保管库访问策略,允许功能应用程序访问密钥保管库中的密钥
我的问题是在密钥保险库访问策略的定义中使用为功能应用程序设置的MSI的对象id(主要ID),我怀疑我做错了什么(和/或愚蠢)...
我从Terraform应用中得到的错误是:
azurerm_key_vault_access_policy.msi-test-to-keyvault-test: "object_id" is an invalid UUUID: uuid: UUID string too short: 1
我怀疑问题可能与我试图引用在访问策略定义中创建的msi身份创建的服务原则的对象id的方式有关:
object_id = "${azurerm_function_app.rg-func-app__funcapp.identity.principal_id}"
(doco for azurerm function app属性部分说标识导出principle_id,但我不知道正确的语法是什么引用这个属性:()
Terraform模板是:
resource "azurerm_function_app" "rg-func-app__funcapp" {
name = "${local.deployed-func-app-name}"
location = "${azurerm_resource_group.rg-func-app.location}"
resource_group_name = "${azurerm_resource_group.rg-func-app.name}"
app_service_plan_id = "${azurerm_app_service_plan.rg-func-app__appsvcpln.id}"
storage_connection_string = "${azurerm_storage_account.rg-func-app__sa.primary_connection_string}"
version = "~1"
app_settings {
"TEST_KEYVAULT_URL" = "${azurerm_key_vault.test.vault_uri}"
}
identity {
type = "SystemAssigned"
}
}
resource "azurerm_key_vault" "test" {
name = "msi-test-vault"
location = "${azurerm_resource_group.rg-func-app.location}"
resource_group_name = "${azurerm_resource_group.rg-func-app.name}"
sku {
name = "standard"
}
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
}
resource "azurerm_key_vault_secret" "test" {
name = "secret-sauce"
value = "szechuan"
vault_uri = "${azurerm_key_vault.test.vault_uri}"
}
resource "azurerm_key_vault_access_policy" "msi-test-to-keyvault-test" {
vault_name = "${azurerm_key_vault.test.name}"
resource_group_name = "${azurerm_key_vault.test.resource_group_name}"
tenant_id = "${azurerm_key_vault.test.tenant_id}"
object_id = "${azurerm_function_app.rg-func-app__funcapp.identity.principal_id}"
key_permissions = [
"get",
]
secret_permissions = [
"get",
]
}
任何指针都感激不尽。
干杯,安迪
经过一番讨论后,解决方案似乎正在改变咒语以检索original_id:
object_id = "${lookup(azurerm_function_app.rg-func-app__funcapp.identity[0],"principal_id")}"
这会导致按预期创建访问策略。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.