azure-devops - 使用 vnet 和防火墙保护时，Azure DevOps Build Pipeline 无法从 Key Vault 获取 secret

Question

当使用 vnet 和防火墙保护时，无法从 Key Vault 获取 secret 。

我想使用 DevOps Build Pipeline 任务中存储在 Key Vault 中的 secret ，我想遵循安全最佳实践和深度防御。作为安全最佳实践，我希望可以从选定的虚拟网络、选定的 azure 服务和受信任的 Internet ip 访问 key 保管库。当然，我会使用服务主体和适当的权限(列表/获取)。

不幸的是，Azure DevOps 不是值得信赖的服务之一。因此，我的替代方案是将 DevOps IP 列入白名单。我发现我的 DevOps 位于美国东部 2 区域，我下载了 Azure 数据中心 IP(使用美国东部 2 过滤)。 US East 2 大约有 285 个 IP。Key Vault 防火墙对您可以添加的防火墙规则数量有限制，它是 127 个!所以，我倒霉了!

目前，只有在我允许所有网络的情况下，我才能在构建管道中从 key 保管库中获取 secret !是的，我仍然需要通过身份验证才能获得 secret ，但我在纵深防御上失败了。我真的需要将 key 保管库锁定到受信任的网络，但我不能。为什么？我添加的防火墙规则不能超过 127 个(覆盖该区域)，而且 DevOps 不是值得信赖的 Azure 服务之一!

Answer 1

我想我会对 Prodip 提供的解决方案进行一些改动。这依赖于这样一个事实，即当您请求一个 secret 时，az 客户端会告诉您您的客户端 IP 地址是什么，即:

az keyvault secret show -n "a-known-client-secret" --vault-name "$keyVaultName"

Attempting to get value for known secret from key vault: '******'
ERROR: Client address is not authorized and caller is not a trusted service.
Client address: 1.1.1.1
Caller: appid=***;oid=****;iss=https://sts.windows.net/***/
Vault: ******;location=******

所以这是我的 bash 脚本(whitelist-agent-for-key-vault.sh):

#!/usr/bin/env bash

## By default the Azure DevOps IP addresses are NOT whitelisted for key vault access. So even if the service principal has access, you won't get past the firewall.
## The solution is to temporarily add the build agent IP address to the key vault firewall, and remove it when the pipeline is complete. 

if [[ $(uname -s) == "Linux" ]]; then
    azcmd="az"
else
    # If we're in a bash shell on Windows, az commands don't work, but we can call the az.cmd batch file directly from git Bash if we can find it...
    azcmd=$(where az.cmd)
fi

# Are we removing rather than setting?
if [[ $1 == "-r" ]]; then
    if [[ -z "$3" ]]; then
        echo "Build agent IP address is empty, no whitelist entry to remove from key vault: '$2'"
    else
        echo "Removing key vault '$2' network rule for DevOps build agent IP address: '$3'"

        # Remember to specify CIDR /32 for removal
        "$azcmd" keyvault network-rule remove -n $2 --ip-address $3/32
    fi
    exit 0
fi

keyVaultName=$1

########################################################################
##### This is the known secret which we request from the key vault #####
########################################################################

knownSecret="<My known secret>"

echo "Attempting to get value for known secret from key vault: '$keyVaultName'"

# Attempt to show secret - if it doesn't work, we are echoed our IP address on stderror, so capture it
secretOutput=$("$azcmd" keyvault secret show -n "$knownSecret" --vault-name "$keyVaultName" 2>&1)
buildAgentIpAddress=$(echo $secretOutput | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")

set -euo pipefail

if [[ ! -z "$buildAgentIpAddress" ]]; then
    # Temporarily whitelist Azure DevOps IP for key vault access.
    # Note use of /32 for CIDR = 1 IP address. If we omit this Azure adds it anyway and fails to match on the IP when attempting removal.
    echo "Azure DevOps IP address '$buildAgentIpAddress' is blocked. Attempting to whitelist..."
    "$azcmd" keyvault network-rule add -n $keyVaultName --ip-address $buildAgentIpAddress/32

    # Capture the IP address as an ADO variable, so that this can be undone in a later step
    echo "##vso[task.setvariable variable=buildAgentIpAddress]$buildAgentIpAddress"
else
    # We didn't find the IP address - are we already whitelisted?
    secretValue=$(echo $secretOutput | grep -o "value")

    if [[ -z "$secretValue" ]]; then
        echo "Unexpected response from key vault whitelist request, json attribute 'value' not found. Unable to whitelist build agent - response was: '$secretOutput'"
        exit 1
    fi
fi

以下是我将 IP 添加到白名单的方法:

  # Add agent IP to key vault white list
  - task: AzureCLI@2
    displayName: Add Azure DevOps build agent IP to key vault white list
    inputs:
      azureSubscription: ${{ parameters.azureSubscription }}
      scriptType: bash
      scriptLocation: scriptPath
      scriptPath: $(Pipeline.Workspace)/server-build-tools/drop/build-scripts/whitelist-agent-for-key-vault.sh
      arguments: '$(keyVaultName)'

这是我从白名单中删除 IP 的方法

      - task: AzureCLI@2
        displayName: Remove Azure DevOps build agent IP from key vault white list
        condition: always()
        inputs:
          azureSubscription: ${{ parameters.azureSubscription }}
          scriptType: bash
          scriptLocation: scriptPath
          scriptPath: $(Pipeline.Workspace)/server-build-tools/drop/build-scripts/whitelist-agent-for-key-vault.sh
          arguments: '-r "$(keyVaultName)" "$(buildAgentIpAddress)"'

注意事项:

这依赖于 Azure DevOps 服务主体已被授予对 key 保管库 secret 的读取访问权限

更换 knownSecret值与您已知的 secret 名称

奖金:

这使用 Azure CLI 工作，并且已经在 Azure DevOps for Linux 和 Windows 构建代理上进行了测试，后者在 Git bash 下运行。通常，如果您尝试在 Git Bash 中运行“az”命令，您只会得到“找不到命令”。我想要一个对两者都适用的解决方案，因为由于 Linux/Windows 构建要求，我需要共享代码。