azure - 部署 Key Vault 访问策略时如何在 Bicep 中引用系统分配的身份

Question

对于一个项目，我想通过 Bicep 模板将三个相关资源部署到 Azure:1) 具有系统分配托管标识的应用服务、2) Key Vault 和 3) 应用服务(步骤 1)对 Key Vault 的访问策略(步骤 2)。

AppService 部署输出系统分配身份的 principalId，稍后在部署 KeyVaultAccessPolicy 时使用该身份。

但是，当我运行 AZ CLI 时(az deployment sub create --location WestEurope --template-file ./main.bicep --parameters ./parameters/parameters-dev.json)要将其部署到 Azure，我收到以下错误:

'The language expression property 'outputs' doesn't exist, available properties are 'templateHash, parameters, mode, provisioningState, timestamp, duration, correlationId, providers, dependencies, outputResources'.

有人知道为什么引用应用服务的 principalId 在这里不起作用吗？非常感谢您的帮助。

模块和main.bicep:

ma​​in.bicep

module appService 'modules/appService.bicep' = {
  name:  'deployAppService'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: appServiceName
    location: appServiceLocation
    alwaysOn: appServiceAlwaysOn
    apimIpAddress: appServiceApimIpAddress
    appServicePlanResourceGroup: appServicePlanResourceGroup
    appServicePlanName: appServicePlanName
  }
}

module keyVault 'modules/keyVault.bicep' = {
  name: 'deployKeyVault'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: keyVaultName
    dependsOn: [ appService ]
    location: appServiceLocation
  }
}

module keyVaultAccessPolicy 'modules/keyVaultAccessPolicy.bicep' = {
  name: 'deployKeyVaultAccessPolicy'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: '${appServiceName}-ap'
    dependsOn: [ keyVault ]
    objectId: appService.outputs.appServiceManagedIdentity
  }
}

appService.bicep

resource appService 'Microsoft.Web/sites@2020-12-01' = {
  name: name
  location: location
  kind: 'app'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: '${subscription().id}/resourceGroups/${appServicePlanResourceGroup}/providers/Microsoft.Web/serverfarms/${appServicePlanName}'
    enabled: true
  }
}

output appServiceManagedIdentity string = appService.identity.principalId

keyVault.bicep

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: name
  location: location
  dependsOn: dependsOn
  properties: {
    enabledForDeployment: true
    enabledForTemplateDeployment: true
    enabledForDiskEncryption: true
    tenantId: subscription().tenantId
    accessPolicies: []
    sku: {
      name: 'standard'
      family: 'A'
    }
  }
}

keyVaultAccessPolicy.bicep

resource keyVaultAccessPolicy 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
  name: name
  dependsOn: dependsOn
  properties: {
    accessPolicies: [
      {
        tenantId: subscription().tenantId
        objectId: objectId
        permissions: {
          secrets: [
            'get'
          ]
        }
      }
    ]
  }
}

Answer 1

已经找到答案:

1. 我错过了模块已经包含 dependsOn 属性，因此无需将依赖项作为 param 传递。
2. KeyVaultAccessPolicy 的名称不包含对父资源 (KeyVault) 的引用，请参阅下面的name: '${keyVaultName}/add'

请参阅下面的工作模块和 main.bicep:

ma​​in.bicep

module appService 'modules/appService.bicep' = {
  name:  'deployAppService'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: appServiceName
    location: appServiceLocation
    alwaysOn: appServiceAlwaysOn
    apimIpAddress: appServiceApimIpAddress
    appServicePlanResourceGroup: appServicePlanResourceGroup
    appServicePlanName: appServicePlanName
  }
}

module keyVault 'modules/keyVault.bicep' = {
  scope: resourceGroup(appServiceResourceGroup)
  name: 'keyVaultDeploy'
  params: {
    location: appServiceLocation
    name: keyVaultName
  }
}

module keyVaultAccessPolicy 'modules/keyVaultAccessPolicy.bicep' = {
  scope: resourceGroup(appServiceResourceGroup)
  name: 'keyVaultAccessPolicyDeploy'
  dependsOn: [
    keyVault
  ]
  params: {
    keyVaultName: keyVaultName
    objectId: appService.outputs.appServiceManagedIdentity
  }
}

appService.bicep

resource appService 'Microsoft.Web/sites@2020-12-01' = {
  name: name
  location: location
  kind: 'app'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    // left out 
  }
}

output appServiceManagedIdentity string = appService.identity.principalId

keyVault.bicep

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: name
  location: location
  properties: {
    enabledForDeployment: true
    enabledForTemplateDeployment: true
    enabledForDiskEncryption: true
    tenantId: subscription().tenantId
    accessPolicies: []
    sku: {
      name: 'standard'
      family: 'A'
    }
  }
}

keyVaultAccessPolicy.bicep

resource keyVaultAccessPolicy 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
  name: '${keyVaultName}/add'
  properties: {
    accessPolicies: [
      {
        tenantId: subscription().tenantId
        objectId: objectId
        permissions: {
          secrets: [
            'get'
          ]
        }
      }
    ]
  }
}