azure-logic-apps - 如何使用托管标识为逻辑应用程序创建到 Azure KeyVault 的 Api 连接

Question

场景

您好，我想创建 Logic App，它从 Azure KeyVault 获取密码，并使用来自 vault 的密码向 API 发送经过身份验证的请求。

问题

我收到:工作流连接参数“keyvault”无效。 API 连接“keyvault”未配置为支持托管身份。 在我的 ARM 部署期间。如何使用 ARM 模板中的托管标识创建 Microsoft.Web/Connections。文档中没有关于它的信息:apiConnection logicapp-MSI

复制

{
  "type": "Microsoft.Web/connections",
  "apiVersion": "2016-06-01",
  "name": "[variables('KeyVault_Connection_Name')]",
  "location": "[variables('location')]",
  "kind": "V1",
  "properties": {
    "api": {
      "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
    },
    "parameterValues": {
      "vaultName": "[variables('keyVaultName')]"
    },
    "displayName": "[variables('KeyVault_Display_Connection_Name')]"
  }
},
{
  "type": "Microsoft.Logic/workflows",
  "apiVersion": "2017-07-01",
  "name": "[variables('logicAppName')]",
  "location": "[variables('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "dependsOn": [
    "[resourceId('Microsoft.Web/Connections', variables('KeyVault_Connection_Name'))]"
  ],
  "properties": {
    "state": "Enabled",
    "definition": {
      "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "$connections": {
          "defaultValue": {},
          "type": "Object"
        }
      },
      "triggers": {schedule trigger},
      "actions": {get secret, send HTTP},
      "outputs": {}
    },
    "parameters": {
      "$connections": {
        "value": {
          "keyvault": {
            "connectionId": "[concat('/subscriptions/', variables('subscriptionId'), '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.Web/connections/', variables('KeyVault_Connection_Name'))]",
            "connectionName": "[variables('KeyVault_Display_Connection_Name')]",
            "connectionProperties": {
              "authentication": {
                "type": "ManagedServiceIdentity"
              }
            },
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'),'/managedApis/keyvault')]"
          }
        }
      }
    }
  }
}

尝试过

我添加了 parameterValueType，其值替代 Microsoft.Web/connections。还需要删除 parameterValue，因为它会导致错误。

{
    "type": "Microsoft.Web/connections",
    "apiVersion": "2016-06-01",
    "name": "[variables('KeyVault_Connection_Name')]",
    "location": "[variables('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
        },
        "parameterValueType": "Alternative",
        "displayName": "[variables('KeyVault_Display_Connection_Name')]"
    }
},

现在我在获取 secret 时在运行时收到错误:

{
  "status": 400,
  "message": "The connection does not contain a vault name. Please edit the connection and enter a valid key vault name.",
  "error": {
    "message": "The connection does not contain a vault name. Please edit the connection and enter a valid key vault name."
  },
  "source": "keyvault-we.azconn-we.p.azurewebsites.net"
}

我也曾尝试将 vaultName 添加到 customParameterValues 但它没有帮助。

Answer 1

与 "parameterValueType": "Alternative" 一起，您还需要在 alternativeParameterValues 中指定要访问的 keyvault 名称，如下所示。

该示例适用于我，joykeyvault123 是我的 keyvualt 名称。

{
    "type": "Microsoft.Web/connections",
    "apiVersion": "2016-06-01",
    "name": "[variables('KeyVault_Connection_Name')]",
    "location": "[variables('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
        },
        "parameterValueType": "Alternative",
        "alternativeParameterValues": {
                    "vaultName": "joykeyvault123"
                },
        "displayName": "[variables('KeyVault_Display_Connection_Name')]"
    }
},