c# - 使用 Pulumi 将应用服务 - 身份分配到 Azure 中的 KeyVault

Question

我使用“经典”Pulumi.Azure 创建应用服务:

        var appservice=new AppService(appserviceName, new AppServiceArgs
        {
            Name = appserviceName,
            Location = _resourceGroup.Location,
            AppServicePlanId = _servicePlan.Id,
            ResourceGroupName = _resourceGroup.Name,
            SiteConfig = new Pulumi.Azure.AppService.Inputs.AppServiceSiteConfigArgs
            {
                DotnetFrameworkVersion = "v5.0",
                ScmType = "None",
            },
            Tags = { { "environemnt", "dev" } },
            Logs = new AppServiceLogsArgs
            {
                HttpLogs = new AppServiceLogsHttpLogsArgs
                {
                    FileSystem = new AppServiceLogsHttpLogsFileSystemArgs { RetentionInDays = 14, RetentionInMb = 35 }
                }
            }
            ,
            AppSettings = appSettings
        });
        

我还创建了一个 keystore :

  var currentConfig=Output.Create(GetClientConfig.InvokeAsync());
            var keyVault = new KeyVault(vaultname, new KeyVaultArgs
            {
                Name = vaultname,
                Location = _resourceGroup.Location,
                ResourceGroupName = _resourceGroup.Name,
                TenantId = currentConfig.Apply(q => q.TenantId),
                SkuName="standard"
                , AccessPolicies=
                {
                     new Pulumi.Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
                     {
                         TenantId=currentConfig.Apply(q=>q.TenantId),
                         ObjectId=currentConfig.Apply(q=>q.ObjectId),
                          KeyPermissions={"get", "create", "list"},
                          SecretPermissions={"set","get","delete","purge","recover", "list"}
                     }
                }
            });

两者都按预期工作。 KeyVault 和应用程序服务正在由我创建和访问。现在我需要应用服务也可以访问 KeyVault。

但是当添加新的访问策略时，我被困在了 ObjectId 上。应用服务似乎没有可以分配给保管库的有效对象 ID。在 Azure 门户上检查服务时，我还发现身份丢失:

那么 pulumi 代码必须做什么才能实现与在 Azure 中单击“On”并随后检索 ObjectId 相同的效果？

Answer 1

您需要在 AppService 上设置以下属性以启用托管身份:

Identity = new AppServiceIdentityArgs {Type = "SystemAssigned"},

此示例说明了端到端实现:https://github.com/pulumi/examples/blob/327afe30ce820901f210ed2a01da408071598ed6/azure-cs-msi-keyvault-rbac/AppStack.cs#L128