azure - 使用 Azure API 管理读取策略中的 Key Vault 值

Question

是否可以读取 Key Vault 中保存的值或命名值中的 Key Vaulted 值？

已在 APIM 中启用托管身份，并在 Key Vault 中创建 Secrete。

<policies>
    <inbound>
        <base />
        <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Error:" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
            <openid-config url="https://xxx" />
            <audiences>
                <audience>read it from Key Vault, or KeyValted value in Named Values</audience>
            </audiences>
            <issuers>
                <issuer>https://openid-connect-eu.onelogin.com/oidc</issuer>
            </issuers>
        </validate-jwt>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

下面的链接似乎相关，但我想知道是否有更简单的代码，例如用于 Azure Functions 的一行代码。

https://madeofstrings.com/2019/06/13/azure-api-management-key-vault-and-managed-identities/

https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-managed-service-identity

Answer 1

我们不能使用与 Azure 功能相同的方式来获取 Azure Key Vault secret 。我们需要使用 MSI 获取访问 token ，然后使用 Key Vault api 通过 token 获取 secret 。更多详情请引用document和 link

1. 配置 MSI

2.在Azure Key Vault中设置访问策略

  Set-AzKeyVaultAccessPolicy -VaultName "your valut name" -ResourceGroupName "your group name" -ObjectId "the principal id you copy" -PermissionsToSecrets get, list, set, delete

配置政策

<send-request mode="new" response-variable-name="responseObj" timeout="30" ignore-error="true">
           <set-url>https://YOUR_KV_HOST/secrets/SEC_NAME/SEC_ID?api-version=7.0</set-url>
           <set-method>GET</set-method>
           <authentication-managed-identity resource="https://vault.azure.net" />
</send-request>
//with this process done , response obj will be setted into context . 

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Error:" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
            <openid-config url="https://xxx" />
            <audiences>
                <audience>@((string)((IResponse)context.Variables["responseObj"]).Body.As<JObject>()["value"])</audience>
//Get value from responeObj in context
            </audiences>
            <issuers>
                <issuer>https://openid-connect-eu.onelogin.com/oidc</issuer>
            </issuers>
</validate-jwt>