使用 ARM 模板将 Azure KeyVault 机密从 KeyVault 获取到应用服务

Question

在 Microsoft KeyVault 资源中我有一个秘密：

        {
          "type": "secrets",
          "apiVersion": "2016-10-01",
          "name": "mongodb",
          "location": "[resourceGroup().location]",
          "dependsOn": [
            "[resourceId('Microsoft.KeyVault/vaults', variables('vault').name)]"
          ],
          "properties": {
            "attributes": {
              "enabled": true
            },
            "value": "[listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosAccountName')), '2019-12-12').connectionStrings[0].connectionString]"
          }
        }

我想提取此值并将其存储在应用服务中的键值对中。

        "siteConfig": {
          "appSettings": [
            {
              "name": "COSMOS_CONNECTION_STRING",
              "value": ""
            }
          ]
        }

他们在同一个资源组。

如何从密钥库中获取值？

Answer 1

要将您的 Azure Key Vault 机密 Get/read 提供给应用服务，您需要创建一个保管库并授予您的应用访问它的权限。
为您之前创建的应用程序标识创建一个 access policy in Key Vault。启用此策略的“获取”秘密权限。不要配置“授权应用程序”或 applicationId 设置，因为这与托管身份不兼容。

`

{
    //...
    "resources": [
        {
            "type": "Microsoft.Storage/storageAccounts",
            "name": "[variables('storageAccountName')]",
            //...
    },
    {
        "type": "Microsoft.Insights/components",
        "name": "[variables('appInsightsName')]",
        //...
    },
    {
        "type": "Microsoft.Web/sites",
        "name": "[variables('functionAppName')]",
        "identity": {
            "type": "SystemAssigned"
        },
        //...
        "resources": [
            {
                "type": "config",
                "name": "appsettings",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
                    "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]",
                    "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('storageConnectionStringName'))]",
                    "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('appInsightsKeyName'))]"
                ],
                "properties": {
                    "AzureWebJobsStorage": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]",
                    "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]",
                    "APPINSIGHTS_INSTRUMENTATIONKEY": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('appInsightsKeyResourceId')).secretUriWithVersion, ')')]",
                    "WEBSITE_ENABLE_SYNC_UPDATE_SITE": "true"
                    //...
                }
            },
            {
                "type": "sourcecontrols",
                "name": "web",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]",
                    "[resourceId('Microsoft.Web/sites/config', variables('functionAppName'), 'appsettings')]"
                ],
            }
        ]
    },
    {
        "type": "Microsoft.KeyVault/vaults",
        "name": "[variables('keyVaultName')]",
        //...
        "dependsOn": [
            "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]"
        ],
        "properties": {
            //...
            "accessPolicies": [
                {
                    "tenantId": "[reference(resourceId('Microsoft.Web/sites/', variables('functionAppName')), '2020-12-01', 'Full').identity.tenantId]",
                    "objectId": "[reference(resourceId('Microsoft.Web/sites/', variables('functionAppName')), '2020-12-01', 'Full').identity.principalId]",
                    "permissions": {
                        "secrets": [ "get" ]
                    }
                }
            ]
        },
        "resources": [
            {
                "type": "secrets",
                "name": "[variables('storageConnectionStringName')]",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]",
                    "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
                ],
                "properties": {
                    "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';AccountKey=', listKeys(variables('storageAccountResourceId'),'2019-09-01').key1)]"
                }
            },
            {
                "type": "secrets",
                "name": "[variables('appInsightsKeyName')]",
                //...
                "dependsOn": [
                    "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]",
                    "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]"
                ],
                "properties": {
                    "value": "[reference(resourceId('microsoft.insights/components/', variables('appInsightsName')), '2019-09-01').InstrumentationKey]"
                }
            }
        ]
    }
]
}

有关通过 arm 模板获取应用程序服务的密钥保管库机密的更多详细信息，请参阅此 Microsoft Documentation

Answer 2

首先，您需要授予 App Service 从 KeyVault 读取密钥的权限，这是通过创建 Access Policy.

来完成的

完成者：

 {
      "type": "Microsoft.KeyVault/vaults/accessPolicies",
      "apiVersion": "2016-10-01",
      "name": "[concat( variables('vault').name, '/replace')]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', variables('vault').name)]",
      ],
      "properties": {
        "accessPolicies": [
          {
            "tenantId": "[subscription().tenantId]",
            "objectId": "[reference(resourceId('Microsoft.Web/sites', variables('AppService').name), '2016-08-01', 'Full').identity.principalId]",
            "permissions": {
              "keys": [
              ],
              "secrets": [
                "Get",
                "List"
              ],
              "certificates": []
            }
          }
        ]
      }
    }

然后您可以通过以下方式访问密钥：

@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)

其中 myvault 是您的保管库的名称，并且 mysecret 是您的密钥的名称

这将创建一个 KeyVault Reference。

使用 ARM 模板将 Azure KeyVault 机密从 KeyVault 获取到应用服务

Get Azure KeyVault Secrets from the KeyVault to an App Service using ARM Templates

azure

azure-web-app-service

azure-devops

azure-template