azure - 通过 ARM 模板使用参数(数组类型)为多个对象 ID 设置 key 保管库访问策略

Question

是否可以通过 ARM 模板使用数组类型的参数为多个对象 ID 设置 key 保管库访问策略？

    "policies": {
            "value": [
              {
                "objectId": "<object-id-1>",
                "permissions": ["get", "set", "list"]
              },
              {
                "objectId": "<object-id-2>",
                "permissions": ["get", "set", "list"]
              }
            ]
          }

我需要将 key 保管库访问策略设置为两个对象 ID，如上所示。这是我尝试过的:

我看到以下错误:

[错误]InvalidTemplate:部署模板验证失败:“资源“Microsoft.KeyVault/vaults/keyvaultname/accessPolicies/add”在模板中定义了多次。

Answer 1

看来你已经快到了。这是我正在工作的对您发布的内容的修改。

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVaultName": {
      "type": "string"
    },
    "policies": {
      "type": "array",
      "metadata": {
        "description": "Array of object ids and permissions."
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults/accessPolicies",
      "name": "[concat(parameters('keyVaultName'), '/add')]",
      "apiVersion": "2019-09-01",
      "properties": {
        "copy": [
          {
            "name": "accessPolicies",
            "count": "[length(parameters('policies'))]",
            "input": {
              "tenantId": "[parameters('policies')[copyIndex('accessPolicies')].tenantId]",
              "objectId": "[parameters('policies')[copyIndex('accessPolicies')].objectId]",
              "permissions": {
                "keys": "[parameters('policies')[copyIndex('accessPolicies')].keys]",
                "secrets": "[parameters('policies')[copyIndex('accessPolicies')].secrets]",
                "certificates": "[parameters('policies')[copyIndex('accessPolicies')].certificates]"
              }
            }
          }
        ]
      }
    }
  ]
}

这是我在部署调用中添加的 PowerShell 变量。

$parameters = @{
  'keyVaultName' = 'kv62443460'
  'policies' = @(
    @{
        'tenantId' = '<GUID>'
        'objectId' = '<GUID>'
        'keys' = @()
        'secrets' = @('get')
        'certificates' = @()
    },
    @{
        'tenantId' = '<GUID>'
        'objectId' = '<GUID>'
        'keys' = @()
        'secrets' = @()
        'certificates' = @('list')
    }
  )
}