Terraform部署azurerm_app_service_certificate失败，错误码59716

问题场景 #

尝试通过Terraform的azurerm_app_service_certificate资源部署Azure App Service证书，配置代码如下：

resource "azurerm_app_service_certificate" "cert" {
  name                = "testcert"
  resource_group_name = var.resource_group_name
  location            = "eastus"
  key_vault_id        = data.azurerm_key_vault.cert_keyvault.id
  key_vault_secret_id = "https://Test- KV.vault.azure.net/secrets/Testcert/3d10d62bc5da4f31b09a9a90e8189bca"
}

执行terraform apply时操作失败，报错信息：

creating/updating Certificate: (Name "testcert" / Resource Group "Test-RG"):
web.CertificatesClient#CreateOrUpdate: Failure responding to request: StatusCode=400 --
Original Error: autorest/azure: Service returned an error. Status=400 Code="BadRequest"
Message="服务无权访问Key Vault '/subscriptions/XXXXXX-XXX-XXXX-XXXX-XXXXXXXXXX/resourcegroups/Test-RG/providers/microsoft.keyvault/vaults/Test-KV'。请确保已为服务授予执行请求操作所需的必要权限。" Details=[{"Message":"服务无权访问Key Vault '/subscriptions/XXXXXX-XXX-XXXX-XXXX-XXXXXXXXXX/resourcegroups/Test-RG/providers/microsoft.keyvault/vaults/Test-KV'。请确保已为服务授予执行请求操作所需的必要权限。"}, {"Code":"BadRequest"},{"ErrorEntity": {"Code":"BadRequest","ExtendedCode":"59716","Message":"服务无权访问Key Vault '/subscriptions/XXXXXX-XXX-XXXX-XXXX-XXXXXXXXXX/resourcegroups/Test-RG/providers/microsoft.keyvault/vaults/Test-KV'。请确保已为服务授予执行请求操作所需的必要权限。","MessageTemplate":"服务无权访问'{0}' Key Vault。请确保已为服务授予执行请求操作所需的必要权限。","Parameters":["/subscriptions/XXXXXX-XXX-XXXX-XXXX-XXXXXXXXXX/resourcegroups/Test-RG/providers/microsoft.keyvault/vaults/Test-KV"]}}]

解决方案 #

该错误是由于Azure App Service后台服务未获得目标Key Vault的访问权限，按以下步骤修复：

1. 获取Azure Web Apps全局服务主体ID #

Azure Web Apps使用固定的全局服务主体（适用于公共区域），ID为：abfa0a7c-a6b6-4736-8310-5855508787cd

2. 为服务主体配置Key Vault访问策略 #

需要授予该服务主体Key Vault的密钥、机密、证书的Get和List权限，可通过两种方式配置：

方式一：Azure CLI命令

az keyvault set-policy --name Test-KV --resource-group Test-RG --object-id abfa0a7c-a6b6-4736-8310-5855508787cd --secret-permissions get list --key-permissions get list --certificate-permissions get list

方式二：Terraform集成配置

若要通过Terraform统一管理权限，在Key Vault资源中添加访问策略块：

resource "azurerm_key_vault" "cert_keyvault" {
  # 保留原有Key Vault配置
  name                = "Test-KV"
  resource_group_name = var.resource_group_name
  location            = var.location
  tenant_id           = data.azurerm_client_config.current.tenant_id

  access_policy {
    object_id = "abfa0a7c-a6b6-4736-8310-5855508787cd" # Web Apps服务主体ID
    secret_permissions = ["Get", "List"]
    key_permissions    = ["Get", "List"]
    certificate_permissions = ["Get", "List"]
  }

  # 其他原有配置...
}

3. 检查Key Vault网络访问限制 #

如果Key Vault启用了防火墙或虚拟网络隔离：

• 进入Key Vault的「网络」设置，开启「允许受信任的Microsoft服务访问此密钥保管库」
• 若Terraform执行环境是固定IP，需将该IP加入Key Vault的允许列表

4. 重新执行部署 #

完成以上配置后，重新运行terraform apply即可完成证书部署。

内容的提问来源于stack exchange，提问作者mystack