代码之家 › 专栏 › 技术社区 › Gregory Suvalian

如何在ARM模板的参数部分引用密钥库中的secret作为默认值

azure-resource-manager

Gregory Suvalian · 技术社区 · 4 年前

我试图在ARM模板的参数部分设置安全字符串的默认值,如下所示,但收到无法使用的错误 reference 参数部分中的函数。是否可以指定安全字符串的默认值以指向现有的密钥库密钥?

    "adminPassword": {
         "type": "secureString",
         "defaultValue": [reference(resourceid(subscription().subscriptionId, resourceGroup().name, 'Microsoft.KeyVault/vaults/secrets', concat(parameters('organisationName'),'-', take(uniqueString(resourceGroup().id),10), '-kv'), 'adminPassword')).secretUri]
         }
      },

0 回复 | 直到 4 年前

Nancy Xiong 4 年前

您可以通过传递密钥库的资源标识符和密钥名称来引用密钥:

例如

  "adminPassword": {
    "reference": {
      "keyVault": {
      "id": "/subscriptions/<subscription-id>/resourceGroups/<rg-name>/providers/Microsoft.KeyVault/vaults/<vault-name>"
      },
      "secretName": "ExamplePassword"
    }
  },

您无法在参数文件中动态生成资源ID,因为参数文件中不允许使用模板表达式。

但是,您可以通过以下方式动态生成密钥保管库密钥的资源ID 使用链接模板 。阅读更多详细信息 reference secrets with dynamic ID

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
      "location": {
        "type": "string",
        "defaultValue": "[resourceGroup().location]",
        "metadata": {
          "description": "The location where the resources will be deployed."
        }
      },
      "vaultName": {
        "type": "string",
        "metadata": {
          "description": "The name of the keyvault that contains the secret."
        }
      },
      "secretName": {
        "type": "string",
        "metadata": {
          "description": "The name of the secret."
        }
      },
      "vaultResourceGroupName": {
        "type": "string",
        "metadata": {
          "description": "The name of the resource group that contains the keyvault."
        }
      },
      "vaultSubscription": {
        "type": "string",
        "defaultValue": "[subscription().subscriptionId]",
        "metadata": {
          "description": "The name of the subscription that contains the keyvault."
        }
      }
  },
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2018-05-01",
      "name": "dynamicSecret",
      "properties": {
        "mode": "Incremental",
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "adminLogin": {
              "type": "string"
            },
            "adminPassword": {
              "type": "securestring"
            },
            "location": {
              "type": "string"
            }
          },
          "variables": {
            "sqlServerName": "[concat('sql-', uniqueString(resourceGroup().id, 'sql'))]"
          },
          "resources": [
            {
              "type": "Microsoft.Sql/servers",
              "apiVersion": "2018-06-01-preview",
              "name": "[variables('sqlServerName')]",
              "location": "[parameters('location')]",
              "properties": {
                "administratorLogin": "[parameters('adminLogin')]",
                "administratorLoginPassword": "[parameters('adminPassword')]"
              }
            }
          ],
          "outputs": {
            "sqlFQDN": {
              "type": "string",
              "value": "[reference(variables('sqlServerName')).fullyQualifiedDomainName]"
            }
          }
        },
        "parameters": {
          "location": {
            "value": "[parameters('location')]"
          },
          "adminLogin": {
            "value": "ghuser"
          },
          "adminPassword": {
            "reference": {
              "keyVault": {
                "id": "[resourceId(parameters('vaultSubscription'), parameters('vaultResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('vaultName'))]"
              },
              "secretName": "[parameters('secretName')]"
            }
          }
        }
      }
    }
  ],
  "outputs": {
  }
}