使用 ARM 模板從 KeyVault 獲取 Azure KeyVault 機密到應用服務

Question

在 Microsoft KeyVault 資源中我有一個秘密：

        {
          "type": "secrets",
          "apiVersion": "2016-10-01",
          "name": "mongodb",
          "location": "[resourceGroup().location]",
          "dependsOn": [
            "[resourceId('Microsoft.KeyVault/vaults', variables('vault').name)]"
          ],
          "properties": {
            "attributes": {
              "enabled": true
            },
            "value": "[listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosAccountName')), '2019-12-12').connectionStrings[0].connectionString]"
          }
        }

我想提取此值並將其存儲在應用服務中的鍵值對中。

        "siteConfig": {
          "appSettings": [
            {
              "name": "COSMOS_CONNECTION_STRING",
              "value": ""
            }
          ]
        }

他們在同一個資源組中。

如何從 keyvault 中獲取值？

Answer 1

• 要獲取/讀取應用服務的 Azure Key Vault Secrets，您需要創建一個保管庫並授予您的應用訪問它的權限。

• 在 Key Vault 中為你之前創建的應用程序標識創建訪問策略。 啟用此策略的“獲取”秘密權限。 不要配置“授權應用程序”或applicationId設置，因為這與托管標識不兼容。

`

{
    //...
    "resources": [
        {
            "type": "Microsoft.Storage/storageAccounts",
            "name": "[variables('storageAccountName')]",
            //...
    },
    {
        "type": "Microsoft.Insights/components",
        "name": "[variables('appInsightsName')]",
        //...
    },
    {
        "type": "Microsoft.Web/sites",
        "name": "[variables('functionAppName')]",
        "identity": {
            "type": "SystemAssigned"
        },
        //...
        "resources": [
            {
                "type": "config",
                "name": "appsettings",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
                    "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]",
                    "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('storageConnectionStringName'))]",
                    "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('appInsightsKeyName'))]"
                ],
                "properties": {
                    "AzureWebJobsStorage": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]",
                    "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]",
                    "APPINSIGHTS_INSTRUMENTATIONKEY": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('appInsightsKeyResourceId')).secretUriWithVersion, ')')]",
                    "WEBSITE_ENABLE_SYNC_UPDATE_SITE": "true"
                    //...
                }
            },
            {
                "type": "sourcecontrols",
                "name": "web",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
                    "[resourceId('Microsoft.Web/sites/config', variables('functionAppName'), 'appsettings')]"
                ],
            }
        ]
    },
    {
        "type": "Microsoft.KeyVault/vaults",
        "name": "[variables('keyVaultName')]",
        //...
        "dependsOn": [
            "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]"
        ],
        "properties": {
            //...
            "accessPolicies": [
                {
                    "tenantId": "[reference(resourceId('Microsoft.Web/sites/', variables('functionAppName')), '2020-12-01', 'Full').identity.tenantId]",
                    "objectId": "[reference(resourceId('Microsoft.Web/sites/', variables('functionAppName')), '2020-12-01', 'Full').identity.principalId]",
                    "permissions": {
                        "secrets": [ "get" ]
                    }
                }
            ]
        },
        "resources": [
            {
                "type": "secrets",
                "name": "[variables('storageConnectionStringName')]",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]",
                    "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
                ],
                "properties": {
                    "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';AccountKey=', listKeys(variables('storageAccountResourceId'),'2019-09-01').key1)]"
                }
            },
            {
                "type": "secrets",
                "name": "[variables('appInsightsKeyName')]",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]",
                    "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]"
                ],
                "properties": {
                    "value": "[reference(resourceId('microsoft.insights/components/', variables('appInsightsName')), '2019-09-01').InstrumentationKey]"
                }
            }
        ]
    }
]
}

• 有關通過 arm 模板獲取應用服務的密鑰保管庫機密的更多詳細信息，請參閱此Microsoft 文檔

Answer 2

首先，您需要授予App Service從KeyVault讀取密鑰的權限，這是通過創建Access Policy來完成的。

這是通過以下方式完成的：

 {
      "type": "Microsoft.KeyVault/vaults/accessPolicies",
      "apiVersion": "2016-10-01",
      "name": "[concat( variables('vault').name, '/replace')]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', variables('vault').name)]",
      ],
      "properties": {
        "accessPolicies": [
          {
            "tenantId": "[subscription().tenantId]",
            "objectId": "[reference(resourceId('Microsoft.Web/sites', variables('AppService').name), '2016-08-01', 'Full').identity.principalId]",
            "permissions": {
              "keys": [
              ],
              "secrets": [
                "Get",
                "List"
              ],
              "certificates": []
            }
          }
        ]
      }
    }

然后您可以通過以下方式訪問密鑰：

@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)

其中myvault是您的保管庫的名稱， mysecret是您的密鑰的名稱

這將創建一個KeyVault Reference 。