如何使用托管标识为逻辑应用程序创建与 Azure KeyVault 的 Api 连接

Question

场景

你好，我想创建 Logic App，它从 Azure KeyVault 获取秘密，并使用来自保险库的秘密向 API 发送经过身份验证的请求。

问题

我在 ARM 部署期间收到：The workflow connection parameter 'keyvault' is not valid. The API connection 'keyvault' is not configured to support managed identity.。如何使用 ARM 模板中的托管身份创建 Microsoft.Web/Connections。文档中没有关于它的信息：apiConnection logicapp-MSI

重现

{
  "type": "Microsoft.Web/connections",
  "apiVersion": "2016-06-01",
  "name": "[variables('KeyVault_Connection_Name')]",
  "location": "[variables('location')]",
  "kind": "V1",
  "properties": {
    "api": {
      "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
    },
    "parameterValues": {
      "vaultName": "[variables('keyVaultName')]"
    },
    "displayName": "[variables('KeyVault_Display_Connection_Name')]"
  }
},
{
  "type": "Microsoft.Logic/workflows",
  "apiVersion": "2017-07-01",
  "name": "[variables('logicAppName')]",
  "location": "[variables('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "dependsOn": [
    "[resourceId('Microsoft.Web/Connections', variables('KeyVault_Connection_Name'))]"
  ],
  "properties": {
    "state": "Enabled",
    "definition": {
      "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "$connections": {
          "defaultValue": {},
          "type": "Object"
        }
      },
      "triggers": {schedule trigger},
      "actions": {get secret, send HTTP},
      "outputs": {}
    },
    "parameters": {
      "$connections": {
        "value": {
          "keyvault": {
            "connectionId": "[concat('/subscriptions/', variables('subscriptionId'), '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.Web/connections/', variables('KeyVault_Connection_Name'))]",
            "connectionName": "[variables('KeyVault_Display_Connection_Name')]",
            "connectionProperties": {
              "authentication": {
                "type": "ManagedServiceIdentity"
              }
            },
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'),'/managedApis/keyvault')]"
          }
        }
      }
    }
  }
}

尝试过

我添加了 parameterValueType 值 Alternative to Microsoft.Web/connections。还需要删除 parameterValue，因为它会导致错误。

{
    "type": "Microsoft.Web/connections",
    "apiVersion": "2016-06-01",
    "name": "[variables('KeyVault_Connection_Name')]",
    "location": "[variables('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
        },
        "parameterValueType": "Alternative",
        "displayName": "[variables('KeyVault_Display_Connection_Name')]"
    }
},

现在我在获取机密时在运行时收到错误消息：

{
  "status": 400,
  "message": "The connection does not contain a vault name. Please edit the connection and enter a valid key vault name.",
  "error": {
    "message": "The connection does not contain a vault name. Please edit the connection and enter a valid key vault name."
  },
  "source": "keyvault-we.azconn-we.p.azurewebsites.net"
}

我也曾尝试将 vaultName 添加到 customParameterValues，但没有帮助。

Answer 1

除了 "parameterValueType": "Alternative"，您还需要在 alternativeParameterValues 中指定要访问的密钥保管库名称，如下所示。

示例适合我，joykeyvault123 是我的密钥库名称。

{
    "type": "Microsoft.Web/connections",
    "apiVersion": "2016-06-01",
    "name": "[variables('KeyVault_Connection_Name')]",
    "location": "[variables('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
        },
        "parameterValueType": "Alternative",
        "alternativeParameterValues": {
                    "vaultName": "joykeyvault123"
                },
        "displayName": "[variables('KeyVault_Display_Connection_Name')]"
    }
},

如何使用托管标识为逻辑应用程序创建与 Azure KeyVault 的 Api 连接

How to create Api connection to Azure KeyVault for Logic App with Managed Identity

azure-resource-manager

azure-logic-apps

azure-keyvault

azure-managed-identity