ARM 模板 - 使用激活和到期日期将机密添加到密钥库

Question

通过arm模板创建密文时，有什么方法可以添加激活日期和到期时间吗？

当我导出 Key Vault 模板时，我看到了这个：

        {
        "type": "Microsoft.KeyVault/vaults/secrets",
        "apiVersion": "2021-11-01-preview",
        "name": "[concat(parameters('vaults_we_devops_poc_kv_23_name'), '/DBConnectionStringPassword')]",
        "location": "westeurope",
        "dependsOn": [
            "[resourceId('Microsoft.KeyVault/vaults', parameters('vaults_we_devops_poc_kv_23_name'))]"
        ],
        "properties": {
            "attributes": {
                "enabled": true,
                "nbf": 1648627063, - secret activation date
                "exp": 2027318262 - secret expiration date
            }
        }
    }

我认为这个整数每个秘密都是唯一的，所以我不能只在 arm 模板中添加这两个。 我已经尝试在 arm 模板中添加这两个值，但没有任何反应。

        {
        "type": "Microsoft.KeyVault/vaults/secrets",
        "apiVersion": "2021-11-01-preview",
        "name": "[concat(parameters('vaults_we_devops_poc_kv_23_name'), '/DBConnectionStringPassword')]",
        "location": "westeurope",
        "dependsOn": [
            "[resourceId('Microsoft.KeyVault/vaults', parameters('vaults_we_devops_poc_kv_23_name'))]"
        ],
        "properties": {
            "attributes": {
                "enabled": true
            }
        }
    }

Answer 1

根据文档，整数是以秒为单位的时间，您可以使用 PowerShell 计算它们的值：

$ActivationTime =  Get-Date -Year 2022 -Month 04 -Day 15 -UFormat %s
$ExpiryTime =  Get-Date -Year 2022 -Month 05 -Day 15 -UFormat %s

然后，您可以将这些值传递到与此类似的模板中：

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "activationTime": {
            "type": "int"
        },
        "expiryTime": {
            "type": "int"
        },
        "secretValue": {
            "type": "securestring"
        }
    },
    "resources": [
        {
            "type": "Microsoft.KeyVault/vaults/secrets",
            "apiVersion": "2021-10-01",
            "name": "my-key-vault/test-secret",
            "properties": {
                "attributes": {
                    "enabled": true,
                    "exp": "[parameters('expiryTime')]",
                    "nbf": "[parameters('activationTime')]"
                },
                "value": "[parameters('secretValue')]"
            }
        }
    ]
}

然后部署使用：

$Value = "my-secret-value"
$SecretValue = $Value | ConvertTo-SecureString -AsPlainText -Force
New-AzResourceGroupDeployment -Name TestSecretTemplate -ResourceGroupName my-resources-rg -TemplateFile .\deployment.json -activationTime $ActivationTime -expiryTime $ExpiryTime -secretValue $SecretValue