如何在 ARM 模板的输出部分获取密钥的最新版本？

Question

我需要在从 ARM 模板生成的 arm 模板（在 Azure 的 Key Vault 中生成）的输出部分获取最新版本的密钥。我怎样才能得到它？我需要将输出用作管道中下一个作业的输入。

Answer 1

用于 ARM 部署的较新版本的 Key Vault 提供程序支持创建密钥，您可以参考下面的示例 ARM 模板中所示。

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vaultName": {
      "type": "string"
    },
    "objectId": {
      "type": "string",
      "metadata": {
        "description": "The unique principal ID within the tenant to which key wrap and unwrap permissions are given."
      }
    },
    "keyName": {
      "type": "string",
      "defaultValue": "test-key"
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]"
    },
    "tenantId": {
      "type": "string",
      "defaultValue": "[subscription().tenantId]",
      "metadata": {
        "description": "Tenant ID of the ACtive Directory to authenticate access. Default is the current subscription's tenant ID."
      }
    }
  },
  "variables": {
    "apiVersion": "2019-09-01"
  },
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "[variables('apiVersion')]",
      "name": "[parameters('vaultName')]",
      "location": "[parameters('location')]",
      "properties": {
        "sku": {
          "family": "A",
          "name": "standard"
        },
        "tenantId": "[parameters('tenantId')]",
        "accessPolicies": [
          {
            "tenantId": "[parameters('tenantId')]",
            "objectId": "[parameters('objectId')]",
            "permissions": {
              "keys": [
                "wrapKey",
                "unwrapKey"
              ]
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.KeyVault/vaults/keys",
      "apiVersion": "[variables('apiVersion')]",
      // The name must include the vault name and key name separated by a slash.
      "name": "[concat(parameters('vaultName'), '/', parameters('keyName'))]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('vaultName'))]"
      ],
      "properties": {
        "kty": "RSA",
        "keySize": 4096,
        "keyOps": [
          "wrapKey",
          "unwrapKey"
        ]
      }
    }
  ],
  "outputs": {
    "keyName": {
      "type": "string",
      "value": "[parameters('keyName')]"
    },
    // Despite the delimited resource name above, we need to construct a 2-parameter resource ID to reference the created key.
    "keyUri": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName'))).keyUri]"
    },
    "keyVersionUri": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName'))).keyUriWithVersion]"
    }
  }
}

请注意有关如何以不同方式创建和引用键的注释。简单地对分隔名称使用 reference() 模板函数会导致模板无效，因此您必须构建一个 resourceId() 尽管在示例模板中。

根据需要调整访问策略。此示例为您传递密钥包装和解包功能的主体提供了可用于块加密密码的功能。

要使用此模板（例如保存为 keyvault-template.json），

az group create -n rg-mytestkv -l westus2
az deployment group create -g rg-mytestkv --template-file keyvault-template.json --parameters vaultName=mytestkv objectId=$(az account show --query id)

如何在 ARM 模板的输出部分获取密钥的最新版本？

How to get the Key's latest version in Output section of an ARM Template?

key

azure

azure-keyvault

azure-devops

arm-template