ARM 参数数组中的密钥库引用

Question

我经常在 ARM 的模板参数文件中使用密钥库引用来安全地传入机密。

现在，我尝试传入一个 keyvault 引用的对象数组，而不是使用单个 keyvaulted 参数。不幸的是，这不起作用。背景信息：我正在尝试从主密钥库部署/派生辅助密钥库，并传输/复制一些条目。

为此，在我的模板中部署以下资源：

{
            "type": "Microsoft.KeyVault/vaults",
            "name": "my-new-sub-vault",
            "apiVersion": "2015-06-01",
            "location": "[resourceGroup().location]",
            "properties": {
                "enabledForDeployment": "false",
                "enabledForTemplateDeployment": "false",
                "enabledForVolumeEncryption": "false",
                "tenantId": "[subscription().tenantId]",
                "accessPolicies": [
                    {
                        "tenantId": "[subscription().tenantId]",
                        "objectId": "[parameters('msiObjectId')]",
                        "permissions": {
                            "keys": ["get", "list"],
                            "secrets": ["get", "list"]
                        }
                    }
                ],
                "sku": {
                    "name": "Standard",
                    "family": "A"
                }
            }
        },
        {
            "type": "Microsoft.KeyVault/vaults/secrets",
            "name": "[concat('my-new-sub-vault', '/', parameters('secretsObject').secrets[copyIndex()].secretName)]",
            "apiVersion": "2015-06-01",
            "properties": {
                "value": "[parameters('secretsObject').secrets[copyIndex()].secretValue]"
            },
            "dependsOn": [
                "[concat('Microsoft.KeyVault/vaults/my-new-sub-vault')]"
            ],
            "copy": {
                "name": "secretsCopy",
                "count": "[length(parameters('secretsObject').secrets)]"
            }
        }

我的语法有错误吗？或者这不可能？

抛出的错误是

New-AzResourceGroupDeployment：16:25:54 - 资源 Microsoft.KeyVault/vaults/secrets 'my-new-sub-vault/my-secret' 失败并显示消息 '{ "error": { "code": "BadRequest", "message": "秘密丢失" } }'

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "secretsObject": {
            "value": {
                "secrets": [						
                    ...,
                    {
                        "secretName": "my-secret",
                        "secretValue": {
                            "reference": {
                              "keyVault": {
                                "id": "/subscriptions/subId/resourceGroups/main/providers/Microsoft.KeyVault/vaults/master-vault"
                              },
                              "secretName": "my-secret"
                            }
                        }
                    }
                ]
            }
        }
    }
}

干杯

Answer 1

另一种选择是将机密存储到 KeyVault 中的单个机密中，格式为 JSON 对象。然后，您可以使用单个资源编写它并使用单个引用读取它。您可以使用 string() 和 json() 函数将其与可在部署期间使用的对象相互转换。

创建“单一秘密”：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVaultName": {
      "type": "string",
      "metadata": {
        "description": "Name of the vault"
      }
    },
    "secretName": {
      "type": "string",
      "metadata": {
        "description": "Name of the secret to store in the vault"
      }
    },
    "secretValue": {
      "type": "secureObject",
      "metadata": {
        "description": "Value of the secret to store in the vault"
      }
    }
  },
  "variables": { },
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]",
      "apiVersion": "2018-02-14",
      "tags": {
        "displayName": "secret"
      },
      "properties": {
        "value": "[string(parameters('secretValue'))]"
      }
    }
  ]
}

使用它来消耗秘密：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "secretValue": {
      "type": "securestring"
    }
  },
  "variables": {
    "toJSON": "[json(parameters('secretValue'))]"
  },
  "resources": [ ],
  "outputs": {
    "secretValue": {
      "type": "string",
      "value": "[parameters('secretValue')]"
    },
    "singleObj": {
      "type": "object",
      "value": "[variables('toJSON')]"
    },
    "singleProperty": {
      "type": "string",
      "value": "[variables('toJSON').two]"
    }
  }
}

在创建参数文件时，参数文件将包含一个带有您的秘密的 json 对象，然后您使用 OP 中的引用参数语法进行引用。

Answer 2

不幸的是，这不起作用，但是，您可以使用嵌套模板循环来解决这个问题。像这样：

{
    "apiVersion": "2017-05-10",
    "name": "[concat('kvReference-', copyIndex())]",
    "type": "Microsoft.Resources/deployments",
    "copy": {
        "name": "kvReference",
        "count": 2
    },
    "properties": {
        "mode": "Incremental",
        "templateLink": {
            "uri": "[uri(deployment().properties.templateLink.uri, 'nested-kv-reference.json')]"
        },
        "parameters": {
            "parameter": {
                "reference": {
                    "keyVault": {
                        "id": "[variables('kvUri')]"
                    },
                    "secretName": "secretName"
                }
            }
        }
    }
},

您嵌套的模板必须按原样输出它们，然后您可以稍后在模板中引用它们：

reference('kvReference-', copyIndex()).outputs.valueName.value

或者您可以将它们用作嵌套模板中的参数。您可以使它们成为安全的字符串类型，这样这些值就不会暴露在门户\api中。