azure - Terraform Azure AD Web 应用程序不会将客户端 ID 和密码传递到 Key Vault

Question

我最近在 Terraform 中创建了 AzureAD 应用程序，但是当我尝试将其客户端 ID 和密码作为 secret 传递到 Key Vault 时，我只是收到诸如 no resources returned in main.tf 之类的错误> 或者是一个奇怪的。 没有找到匹配过滤器的应用程序:“displayName eq，但 Terraform 甚至还没有制作该应用程序。

请参阅下面的代码

# Terraform Block
terraform {
  required_version = ">= 1.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 2.0"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.0"
    }
  }
  #Terraform State Storage Account
  # backend "azurerm" {}
}

# Providers Block
provider "azurerm" {
  features {}
}
provider "azuread" {
  tenant_id     = "VALUE"
  client_id     = "VALUE"
  client_secret = "VALUE"
}

provider "random" {}
provider "time" {}

# Random String Resource

resource "random_string" "myrandom" {
  length  = 6
  number  = false
  upper   = false
  special = false
}

data "azurerm_client_config" "current" {}

data "azuread_service_principal" "current" {
  object_id = "VALUE" // This will need changing per tenant used for KeyVault
}

data "azuread_user" "user" {
  user_principal_name = "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="2b61055846425f436b4844465b4a455205484446" rel="noreferrer noopener nofollow">[email protected]</a>"
}

data "azuread_group" "Classroom_In_The_Cloud_AZ_AD_Group" {
  display_name     = "companyadgroup"
  security_enabled = true
}

resource "azurerm_key_vault" "Terraform_Testings" {
  #depends_on = [
  # azurerm_storage_container.website_tftestingwebsiteinstaller_account
  #]
  name                       = "cicterraformtesting"
  location                   = azurerm_resource_group.Classroom_In_The_Cloud_Terraform_Testing.location
  resource_group_name        = azurerm_resource_group.Classroom_In_The_Cloud_Terraform_Testing.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "premium"
  soft_delete_retention_days = 7

}

resource "azurerm_key_vault_access_policy" "terraform_testings_client" { // This is for AD Users Logged into Azure to give them the right access when creating resources. 
  key_vault_id            = azurerm_key_vault.Terraform_Testings.id
  tenant_id               = data.azurerm_client_config.current.tenant_id
  object_id               = data.azuread_group.Classroom_In_The_Cloud_AZ_AD_Group.object_id
  secret_permissions      = ["Backup", "Delete", "Get", "List", "Purge", "Recover", "Restore", "Set", ]
  key_permissions         = ["Backup", "Create", "Decrypt", "Delete", "Encrypt", "Get", "Import", "List", "Purge", "Recover", "Restore", "Sign", "UnwrapKey", "Update", "Verify", "WrapKey", ]
  storage_permissions     = ["Backup", "Delete", "DeleteSAS", "Get", "GetSAS", "List", "ListSAS", "Purge", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update", ]
  certificate_permissions = ["create", "delete", "deleteissuers", "get", "getissuers", "import", "list", "listissuers", "managecontacts", "manageissuers", "setissuers", "update", ]
}

resource "azurerm_key_vault_access_policy" "terraform_testings_service_principal" { // This is for the Service Principal in the pipeline to be able to make changes to Key Vault. 
  key_vault_id            = azurerm_key_vault.Terraform_Testings.id
  tenant_id               = data.azurerm_client_config.current.tenant_id
  object_id               = data.azurerm_client_config.current.object_id
  secret_permissions      = ["Backup", "Delete", "Get", "List", "Purge", "Recover", "Restore", "Set", ]
  key_permissions         = ["Backup", "Create", "Decrypt", "Delete", "Encrypt", "Get", "Import", "List", "Purge", "Recover", "Restore", "Sign", "UnwrapKey", "Update", "Verify", "WrapKey", ]
  storage_permissions     = ["Backup", "Delete", "DeleteSAS", "Get", "GetSAS", "List", "ListSAS", "Purge", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update", ]
  certificate_permissions = ["create", "delete", "deleteissuers", "get", "getissuers", "import", "list", "listissuers", "managecontacts", "manageissuers", "setissuers", "update", ]
}



resource "azurerm_key_vault_secret" "WebsiteStorageConnectionString" { // Dont use dempends on, on key vault secrets gets itself in a mess
  name  = "WebsiteStorageConnectionString"
  value = azurerm_storage_account.website_tftestwebinstaller_account.primary_access_key
  #value        = "szechuan"
  key_vault_id = azurerm_key_vault.Terraform_Testings.id
  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
    azurerm_storage_account.website_tftestwebinstaller_account,
  ]

}

resource "azurerm_key_vault_secret" "WebsiteSignalRConnectionString" { // Dont use dempends on, on key vault secrets gets itself in a mess
  name         = "WebsiteSignalRConnectionString"
  value        = format("Endpoint=https://${azurerm_signalr_service.websitesignalr.name}.service.signalr.net;AccessKey=${azurerm_signalr_service.websitesignalr.primary_access_key};Version=1.0;")
  key_vault_id = azurerm_key_vault.Terraform_Testings.id

  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
    azurerm_signalr_service.websitesignalr,
  ]

}

resource "azurerm_key_vault_secret" "AzureADClientID" {
  name         = "AzureADClientID"
  value        = data.azuread_application.websiteadapp.id 
  key_vault_id = azurerm_key_vault.Terraform_Testings.id

  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
    azureread_application.websiteadapp,
  ]

}

resource "azurerm_key_vault_secret" "AzureADAppPassword" {
  name         = "AzureADAppPassword"
  value        = data.azuread_application.websiteadapp.object_id
  key_vault_id = azurerm_key_vault.Terraform_Testings.id

  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
    azuread_application_password.websiteadapp,
  ]

}

resource "azuread_application" "websiteadapp" {
  display_name = var.adapplication_name
  #identifier_uris  = ["api://example-app"]
  owners           = [data.azurerm_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  required_resource_access {
    resource_app_id = "VALUE" # Microsoft Graph

    resource_access {
      id   = "VALUE" # User.Read.All
      type = "Scope"
    }

    resource_access {
      id   = "VALUE" # User.ReadWrite
      type = "Scope"
    }
  }
}

data "azuread_application" "websiteadapp" {
  display_name = var.adapplication_name
  depends_on = [
    azureread_application.websiteadapp,
  ]
}

resource "azuread_application_password" "websiteadapp" {
  application_object_id = azuread_application.websiteadapp.object_id
}

我尝试过删除 Key Vault 中的依赖项，如果您将 Key Vault 从马术中取出，应用程序确实会创建，这确实让我更加困惑。

我已经完成这项任务两天了，并且一直在关注 Terraform 此处链接中列出的文档:

https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application#id

Answer 1

我在您的 terraform 代码中发现了一些问题。

• 当您创建资源“azuread_application”“websiteadapp”时，您不需要数据“azuread_application”“websiteadapp”
• 如果您已经引用此资源，则确实需要使用 dependent_on 指定依赖项。
• 我在 azurerm_key_vault_secret 中没有看到您引用的资源 azurerm_storage_account.website_tftestwebinstaller_account
• 我在 azurerm_key_vault_secret 中没有看到您引用的资源 azurerm_signalr_service.websitesignalr
• 资源“azurerm_key_vault_secret”“AzureADAppPassword”应具有引用azurerm_application_password.websiteadapp.value的值

这是重构后的代码:

# Terraform Block
terraform {
  required_version = ">= 1.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 2.0"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.0"
    }
  }
  #Terraform State Storage Account
  # backend "azurerm" {}
}

# Providers Block
provider "azurerm" {
  features {}
}
provider "azuread" {
  tenant_id     = "VALUE"
  client_id     = "VALUE"
  client_secret = "VALUE"
}

provider "random" {}
provider "time" {}

# Random String Resource

resource "random_string" "myrandom" {
  length  = 6
  number  = false
  upper   = false
  special = false
}

data "azurerm_client_config" "current" {}

data "azuread_service_principal" "current" {
  object_id = "VALUE" // This will need changing per tenant used for KeyVault
}

data "azuread_user" "user" {
  user_principal_name = "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="6822461b05011c00280b070518090611460b0705" rel="noreferrer noopener nofollow">[email protected]</a>"
}

data "azuread_group" "Classroom_In_The_Cloud_AZ_AD_Group" {
  display_name     = "companyadgroup"
  security_enabled = true
}

resource "azurerm_key_vault" "Terraform_Testings" {
  #depends_on = [
  # azurerm_storage_container.website_tftestingwebsiteinstaller_account
  #]
  name                       = "cicterraformtesting"
  location                   = azurerm_resource_group.Classroom_In_The_Cloud_Terraform_Testing.location
  resource_group_name        = azurerm_resource_group.Classroom_In_The_Cloud_Terraform_Testing.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "premium"
  soft_delete_retention_days = 7

}

resource "azurerm_key_vault_access_policy" "terraform_testings_client" { // This is for AD Users Logged into Azure to give them the right access when creating resources. 
  key_vault_id            = azurerm_key_vault.Terraform_Testings.id
  tenant_id               = data.azurerm_client_config.current.tenant_id
  object_id               = data.azuread_group.Classroom_In_The_Cloud_AZ_AD_Group.object_id
  secret_permissions      = ["Backup", "Delete", "Get", "List", "Purge", "Recover", "Restore", "Set", ]
  key_permissions         = ["Backup", "Create", "Decrypt", "Delete", "Encrypt", "Get", "Import", "List", "Purge", "Recover", "Restore", "Sign", "UnwrapKey", "Update", "Verify", "WrapKey", ]
  storage_permissions     = ["Backup", "Delete", "DeleteSAS", "Get", "GetSAS", "List", "ListSAS", "Purge", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update", ]
  certificate_permissions = ["create", "delete", "deleteissuers", "get", "getissuers", "import", "list", "listissuers", "managecontacts", "manageissuers", "setissuers", "update", ]
}

resource "azurerm_key_vault_access_policy" "terraform_testings_service_principal" { // This is for the Service Principal in the pipeline to be able to make changes to Key Vault. 
  key_vault_id            = azurerm_key_vault.Terraform_Testings.id
  tenant_id               = data.azurerm_client_config.current.tenant_id
  object_id               = data.azurerm_client_config.current.object_id
  secret_permissions      = ["Backup", "Delete", "Get", "List", "Purge", "Recover", "Restore", "Set", ]
  key_permissions         = ["Backup", "Create", "Decrypt", "Delete", "Encrypt", "Get", "Import", "List", "Purge", "Recover", "Restore", "Sign", "UnwrapKey", "Update", "Verify", "WrapKey", ]
  storage_permissions     = ["Backup", "Delete", "DeleteSAS", "Get", "GetSAS", "List", "ListSAS", "Purge", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update", ]
  certificate_permissions = ["create", "delete", "deleteissuers", "get", "getissuers", "import", "list", "listissuers", "managecontacts", "manageissuers", "setissuers", "update", ]
}

resource "azurerm_key_vault_secret" "AzureADClientID" {
  name         = "AzureADClientID"
  value        = azuread_application.websiteadapp.id 
  key_vault_id = azurerm_key_vault.Terraform_Testings.id

  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
  ]

}

resource "azurerm_key_vault_secret" "AzureADAppKeyId" {
  name         = "AzureADAppPassword"
  value        = azuread_application_password.websiteadapp.key_id
  key_vault_id = azurerm_key_vault.Terraform_Testings.id

  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
  ]

}

resource "azurerm_key_vault_secret" "AzureADAppPassword" {
  name         = "AzureADAppPassword"
  value        = azuread_application_password.websiteadapp.value
  key_vault_id = azurerm_key_vault.Terraform_Testings.id

  depends_on = [
    azurerm_key_vault_access_policy.terraform_testings_client,
    azurerm_key_vault_access_policy.terraform_testings_service_principal,
  ]

}

resource "azuread_application" "websiteadapp" {
  display_name = var.adapplication_name
  #identifier_uris  = ["api://example-app"]
  owners           = [data.azurerm_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  required_resource_access {
    resource_app_id = "VALUE" # Microsoft Graph

    resource_access {
      id   = "VALUE" # User.Read.All
      type = "Scope"
    }

    resource_access {
      id   = "VALUE" # User.ReadWrite
      type = "Scope"
    }
  }
}

resource "azuread_application_password" "websiteadapp" {
  application_object_id = azuread_application.websiteadapp.object_id
}