azure - 如何检查二头肌文件中是否已存在 KeyVault secret

Question

我有包含 KeyVault 模块和 SQL 服务器模块的二头肌文件。在 SQL Server bicep 文件中，我运行一个部署脚本，该脚本运行一个 PowerShell 脚本来生成密码并将其作为 key 添加到 KeyVault 中。该密码用作 SQL 服务器的管理员密码。

如果 Key Vault 中尚不存在该 key ，我希望脚本仅生成并保存密码。

ma​​in.bicep

// Resource Module
module resourceKeyVaultModule './modules/kv.bicep' = {
  name: 'resourceKeyVaultModuleDeployment'
  params: {
    application: application
    location: location
    environment: environment
    severity: severity
  }
  scope: resourceGroup
}

module resourceSqlServerModule './modules/sql.bicep' = {
  name: 'resourceSqlServerModuleDeployment'
  params: {
    application: application
    location: location
    environment: environment
    severity: severity
    nameKeyVault: resourceKeyVaultModule.outputs.name
  }
  scope: resourceGroup
}

kv.bicep

// == Key Vault
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: nameKeyVault
  location: location
  tags: {
    location: location
    environment: environment
    severity: severity
  }
  properties: {
    accessPolicies: [
      {
        objectId: ''
        permissions: {
          certificates: [
            'all'
          ]
          keys: [
            'all'
          ]
          secrets: [
            'all'
          ]
          storage: [
            'all'
          ]
        }
        tenantId: ''
      }
    ]
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: '
  }
}

output name string = keyVault.name

sql.bicep

// == Generate Password
resource generatePassword 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: 'generatePassword'
  location: location
  kind: 'AzurePowerShell'
  properties: {
    azPowerShellVersion: '3.0'
    retentionInterval: 'PT1H'
    arguments: '-lowercase 4 -uppercase 4 -numbers 4 -symbols 2'
    scriptContent: loadTextContent('../../../Scripts/generatePassword.ps1')
  }
}

// == Key Vault
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  name: nameKeyVault
}

// == SQL Server
resource sqlServer 'Microsoft.Sql/servers@2022-05-01-preview' = {
  name: nameSqlServer
  location: location
  tags: {
    location: location
    environment: environment
    severity: severity
  }
  properties: {
    administratorLogin: nameSqlServer
    administratorLoginPassword: generatePassword.properties.outputs.password
    minimalTlsVersion: '1.2'
  }
}

resource secretPasswordSqlAdmin 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
  name: 'password-sql-admin'
  parent: keyVault
  tags: {
    location: location
    environment: environment
    severity: severity
  }
  properties: {
    value: generatePassword.properties.outputs.password
  }
}

Answer 1

虽然这在二头肌文件本身中是不可能的，但您应该在生成新 secret 之前直接在 PowerShell 脚本中检查 secret 。