azure - Terraform - Azure 应用程序网关与 keyvault 证书集成问题

Question

我正在尝试使用 key 保管库中的 ssl 证书部署应用程序 g/w。当我运行 terraform apply 时，它提示错误为 SecretIdSpecifiedIsInvalid ...即使它在错误代码上显示正确的证书 ID 和名称，我可以在门户上手动验证。

我还可以使用 keyvault 中的相同证书手动部署应用程序网关。

│ Error: creating Application Gateway: (Name “poc-appgw-iaps” /Resource Group “poc-rg-appgw”):network.ApplicationGatewaysClient#CreateOrUpdate: Failure sendingrequest: StatusCode=400 – Original Error:Code=“SecretIdSpecifiedIsInvalid” Message=“SecretId‘https://pockv-iaps.vault.azure.net/certificates/poc-cert-admin/xxxxxxxxxx’specified in‘/subscriptions/xxxxxxxxxxxxxxx/resourceGroups/poc-rg-appgw/providers/Microsoft.Network/applicationGateways/poc-appgw-iaps/sslCertificates/poc-cert-admin’is invalid.” Details=[]

Answer 1

• 首先请尝试通过升级到最新版本来解决此问题azurerm terraform 提供商。最新版本应该包含以下修复如果规定全部正确的话情况。
• ssl 证书 block 必须包含您的 PFX 证书。数据如果尚未设置 key 保管库 Secret_id，则必须使用。
• base-64 编码的未加密 pfx 的 key 保管库 secret ID证书/ secret 必须存储在 Azure KeyVault 中。

请注意，要启用上述功能，Azure Key Vault必须启用软删除

请确保具有获取 secret 所需的访问策略。

provider "azurerm" {
    features{}
}
data "azurerm_client_config" "current" {}

resource "azurerm_user_assigned_identity" "base" {
  resource_group_name = "resourcegroup"
  location            = "resgrouplocation"
  name                = "appgwkeyvault"
}

data "azurerm_key_vault" "example"{
    name = "keyvault-name"
    resource_group_name = "resourcegroup"
} 
resource "azurerm_key_vault_access_policy" "example" {
  key_vault_id = data.azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_user_assigned_identity.base.principal_id

  key_permissions = [
    "Get",
  ]

  certificate_permissions = [
      "Get",
  ]
  secret_permissions = [
    "Get",
  ]
}
output "secret_identifier" {
  value = azurerm_key_vault_certificate.example.secret_id
}

//TODO required soft delete on the keyvault
ssl_certificate {
    name = "app_listener"
    key_vault_secret_id = azurerm_key_vault_certificate.example.secret_id
  }

请确保正确给出证书属性， secret 必须为.pfx格式

resource "azurerm_key_vault_certificate" "example" {
  name         = "imported-cert"
  key_vault_id = azurerm_key_vault.kv.id

//make sure certificate is base64 encoded pfx certificate
  certificate {
    contents = filebase64("C:/appgwlistener.pfx")
    password = "password"
  }

  certificate_policy {
   ...
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = false
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }
  }
}

以下引用资料可以为您提供指导:

1. Terraform - How to attach SSL certificate stored in Azure KeyVaultto an Application Gateway - Stack Overflow
2. key_vault_secret_id azure_application_gateway| Terraform Registry