Azure Runbook无法检索Key Vault证书问题求助

我正尝试在Azure Runbook的新Runtime环境中访问Key Vault证书，但无法列出证书。执行以下命令返回null：

$AzureContext = (Connect-AzAccount -Identity -Verbose).context
$certficate = Get-AzKeyVaultCertificate -VaultName $vaultName -Name $certificateName

但在本地或Cloud PowerShell中执行相同命令可正常访问证书。

Runbook环境配置 #

Powershell Version: 5.1
Modules Attached: Az, ExchangeOnlineManagement

我已尝试Key Vault的两种权限配置方式：

• 访问策略：为自动化账户的托管身份授予证书的read和list权限
• RBAC：为自动化账户分配Key Vault Certificates Officer和Key Vault Reader角色，甚至尝试使用带有Key Vault Reader权限的用户分配身份

操作未抛出权限缺失或配置错误等任何错误，仅返回证书的null值。

编辑补充 #

Runtime环境依赖项 #

截图显示Azure Runtime环境中的依赖包版本，包括Az.Accounts 2.13.1、Az.KeyVault 4.8.0、Az.Resources 6.9.0等。

UI问题说明 #

该页面存在内联CSS故障，导致无法直接查看依赖项详情，需临时修改浏览器CSS才能查看。重现步骤：点击任意Azure Runtime环境，无法查看依赖项。若知晓官方反馈渠道，恳请告知。

执行Get-AzKeyVaultCertificate的调试日志（无异常错误） #

Loading module from path 'C:\usr\src\PSModules\Az.KeyVault\KeyVault.Autorest\bin\Az.KeyVault.private.dll'.
Importing cmdlet 'Export-CmdletSurface'.
Importing cmdlet 'Export-ExampleStub'.
Importing cmdlet 'Export-FormatPs1xml'.
Importing cmdlet 'Export-HelpMarkdown'.
Importing cmdlet 'Export-ModelSurface'.
Importing cmdlet 'Export-ProxyCmdlet'.
Importing cmdlet 'Export-Psd1'.
Importing cmdlet 'Export-TestStub'.
Importing cmdlet 'Get-CommonParameter'.
Importing cmdlet 'Get-ModuleGuid'.
Importing cmdlet 'Get-ScriptCmdlet'.
Importing cmdlet 'Get-ParameterForRegion'.
Importing cmdlet 'Get-AzKeyVaultManagedHsmRegion_List'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_Get'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_GetViaIdentity'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_List'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_List1'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckExpanded'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckViaJsonFilePath'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckViaJsonString'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckExpanded'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckViaJsonFilePath'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckViaJsonString'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_Update'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateExpanded'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaIdentity'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaIdentityExpanded'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaJsonFilePath'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaJsonString'.
Loading module from path 'C:\usr\src\PSModules\Az.KeyVault\KeyVault.Autorest\custom\Az.KeyVault.custom.psm1'.
Importing cmdlet 'Export-CmdletSurface'.
Importing cmdlet 'Export-ExampleStub'.
Importing cmdlet 'Export-FormatPs1xml'.
Importing cmdlet 'Export-HelpMarkdown'.
Importing cmdlet 'Export-ModelSurface'.
Importing cmdlet 'Export-ProxyCmdlet'.
Importing cmdlet 'Export-Psd1'.
Importing cmdlet 'Export-TestStub'.
Importing cmdlet 'Get-CommonParameter'.
Importing cmdlet 'Get-ModuleGuid'.
Importing cmdlet 'Get-ScriptCmdlet'.
Importing cmdlet 'Get-ParameterForRegion'.
Importing cmdlet 'Get-AzKeyVaultManagedHsmRegion_List'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_Get'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_GetViaIdentity'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_List'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_List1'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckExpanded'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckViaJsonFilePath'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckViaJsonString'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckExpanded'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckViaJsonFilePath'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckViaJsonString'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_Update'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateExpanded'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaIdentity'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaIdentityExpanded'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaJsonFilePath'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaJsonString'.
Loading module from path 'C:\usr\src\PSModules\Az.KeyVault\KeyVault.Autorest\internal\Az.KeyVault.internal.psm1'.
Importing cmdlet 'Export-CmdletSurface'.
Importing cmdlet 'Export-ExampleStub'.
Importing cmdlet 'Export-FormatPs1xml'.
Importing cmdlet 'Export-HelpMarkdown'.
Importing cmdlet 'Export-ModelSurface'.
Importing cmdlet 'Export-ProxyCmdlet'.
Importing cmdlet 'Export-Psd1'.
Importing cmdlet 'Export-TestStub'.
Importing cmdlet 'Get-CommonParameter'.
Importing cmdlet 'Get-ModuleGuid'.
Importing cmdlet 'Get-ScriptCmdlet'.
Importing cmdlet 'Get-ParameterForRegion'.
Importing cmdlet 'Get-AzKeyVaultManagedHsmRegion_List'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_Get'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_GetViaIdentity'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_List'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm_List1'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckExpanded'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckViaJsonFilePath'.
Importing cmdlet 'Test-AzKeyVaultManagedHsmNameAvailability_CheckViaJsonString'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckExpanded'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckViaJsonFilePath'.
Importing cmdlet 'Test-AzKeyVaultNameAvailability_CheckViaJsonString'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_Update'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateExpanded'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaIdentity'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaIdentityExpanded'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaJsonFilePath'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm_UpdateViaJsonString'.
Exporting function 'Get-AzKeyVaultManagedHsm'.
Exporting function 'Get-ParameterForRegion'.
Exporting function 'Update-AzKeyVaultManagedHsm'.
Importing function 'Get-AzKeyVaultManagedHsm'.
Importing function 'Get-ParameterForRegion'.
Importing function 'Update-AzKeyVaultManagedHsm'.
Exporting function 'Add-AzKeyVaultManagedHsmRegion'.
Exporting function 'Remove-AzKeyVaultManagedHsmRegion'.
Importing function 'Add-AzKeyVaultManagedHsmRegion'.
Importing function 'Remove-AzKeyVaultManagedHsmRegion'.
Exporting function 'Add-AzKeyVaultManagedHsmRegion'.
Exporting function 'Remove-AzKeyVaultManagedHsmRegion'.
Exporting function 'Get-AzKeyVaultManagedHsmRegion'.
Exporting function 'Test-AzKeyVaultManagedHsmNameAvailability'.
Exporting function 'Test-AzKeyVaultNameAvailability'.
Loading module from path 'C:\usr\src\PSModules\Az.KeyVault\Microsoft.Azure.PowerShell.Cmdlets.KeyVault.dll'.
Importing cmdlet 'Add-AzKeyVaultCertificate'.
Importing cmdlet 'Backup-AzKeyVaultCertificate'.
Importing cmdlet 'Add-AzKeyVaultCertificateContact'.
Importing cmdlet 'Get-AzKeyVaultCertificateContact'.
Importing cmdlet 'Remove-AzKeyVaultCertificateContact'.
Importing cmdlet 'Get-AzKeyVaultCertificate'.
Importing cmdlet 'Get-AzKeyVaultCertificateOperation'.
Importing cmdlet 'Import-AzKeyVaultCertificate'.
Importing cmdlet 'Get-AzKeyVaultCertificateIssuer'.
Importing cmdlet 'Remove-AzKeyVaultCertificateIssuer'.
Importing cmdlet 'Set-AzKeyVaultCertificateIssuer'.
Importing cmdlet 'New-AzKeyVaultCertificatePolicy'.
Importing cmdlet 'Set-AzKeyVaultCertificatePolicy'.
Importing cmdlet 'Remove-AzKeyVaultCertificate'.
Importing cmdlet 'Remove-AzKeyVaultCertificateOperation'.
Importing cmdlet 'Restore-AzKeyVaultCertificate'.
Importing cmdlet 'Stop-AzKeyVaultCertificateOperation'.
Importing cmdlet 'Undo-AzKeyVaultCertificateRemoval'.
Importing cmdlet 'Update-AzKeyVaultCertificate'.
Importing cmdlet 'Get-AzKeyVault'.
Importing cmdlet 'New-AzKeyVault'.
Importing cmdlet 'Remove-AzKeyVault'.
Importing cmdlet 'Undo-AzKeyVaultRemoval'.
Importing cmdlet 'Update-AzKeyVault'.
Importing cmdlet 'Add-AzKeyVaultKey'.
Importing cmdlet 'Backup-AzKeyVaultKey'.
Importing cmdlet 'Get-AzKeyVaultKey'.
Importing cmdlet 'Remove-AzKeyVaultKey'.
Importing cmdlet 'Restore-AzKeyVaultKey'.
Importing cmdlet 'Undo-AzKeyVaultKeyRemoval'.
Importing cmdlet 'Update-AzKeyVaultKey'.
Importing cmdlet 'Remove-AzKeyVaultManagedHsm'.
Importing cmdlet 'Undo-AzKeyVaultManagedHsmRemoval'.
Importing cmdlet 'Add-AzKeyVaultManagedStorageAccount'.
Importing cmdlet 'Backup-AzKeyVaultManagedStorageAccount'.
Importing cmdlet 'Get-AzKeyVaultManagedStorageAccount'.
Importing cmdlet 'Get-AzKeyVaultManagedStorageSasDefinition'.
Importing cmdlet 'Remove-AzKeyVaultManagedStorageAccount'.
Importing cmdlet 'Remove-AzKeyVaultManagedStorageSasDefinition'.
Importing cmdlet 'Restore-AzKeyVaultManagedStorageAccount'.
Importing cmdlet 'Set-AzKeyVaultManagedStorageSasDefinition'.
Importing cmdlet 'Undo-AzKeyVaultManagedStorageAccountRemoval'.
Importing cmdlet 'Undo-AzKeyVaultManagedStorageSasDefinitionRemoval'.
Importing cmdlet 'Update-AzKeyVaultManagedStorageAccount'.
Importing cmdlet 'Update-AzKeyVaultManagedStorageAccountKey'.
Importing cmdlet 'Remove-AzKeyVaultAccessPolicy'.
Importing cmdlet 'Backup-AzKeyVaultSecret'.
Importing cmdlet 'Get-AzKeyVaultSecret'.
Importing cmdlet 'Remove-AzKeyVaultSecret'.
Importing cmdlet 'Restore-AzKeyVaultSecret'.
Importing cmdlet 'Set-AzKeyVaultSecret'.
Importing cmdlet 'Undo-AzKeyVaultSecretRemoval'.
Importing cmdlet 'Update-AzKeyVaultSecret'.
Importing cmdlet 'Set-AzKeyVaultAccessPolicy'.
Importing cmdlet 'Add-AzKeyVaultNetworkRule'.
Importing cmdlet 'New-AzKeyVaultNetworkRuleSetObject'.
Importing cmdlet 'Remove-AzKeyVaultNetworkRule'.
Importing cmdlet 'Update-AzKeyVaultNetworkRuleSet'.
Importing cmdlet 'Export-AzKeyVaultSecurityDomain'.
Importing cmdlet 'Import-AzKeyVaultSecurityDomain'.
Importing cmdlet 'New-AzKeyVaultCertificateAdministratorDetail'.
Importing cmdlet 'New-AzKeyVaultCertificateOrganizationDetail'.
Importing cmdlet 'Get-AzKeyVaultCertificatePolicy'.
Importing cmdlet 'Backup-AzKeyVault'.
Importing cmdlet 'Restore-AzKeyVault'.
Importing cmdlet 'Get-AzKeyVaultManagedHsm'.
Importing cmdlet 'New-AzKeyVaultManagedHsm'.
Importing cmdlet 'Update-AzKeyVaultManagedHsm'.
Importing cmdlet 'Get-AzKeyVaultRoleAssignment'.
Importing cmdlet 'Get-AzKeyVaultRoleDefinition'.
Importing cmdlet 'New-AzKeyVaultRoleDefinition'.
Importing cmdlet 'New-AzKeyVaultRoleAssignment'.
Importing cmdlet 'Remove-AzKeyVaultRoleAssignment'.
Importing cmdlet 'Remove-AzKeyVaultRoleDefinition'.
Importing cmdlet 'Get-AzKeyVaultSetting'.
Importing cmdlet 'Update-AzKeyVaultSetting'.
Importing cmdlet 'Get-AzKeyVaultRandomNumber'.
Importing cmdlet 'Invoke-AzKeyVaultKeyOperation'.
Importing cmdlet 'Get-AzKeyVaultKeyRotationPolicy'.
Importing cmdlet 'Set-AzKeyVaultKeyRotationPolicy'.
Importing cmdlet 'Invoke-AzKeyVaultKeyRotation'.
Importing alias 'Set-AzKeyVaultCertificateAttribute'.
Importing alias 'Set-AzKeyVaultKey'.
Importing alias 'Set-AzKeyVaultKeyAttribute'.
Importing alias 'Set-AzKeyVaultSecretAttribute'.
Importing alias 'Set-AzKeyVaultRoleDefinition'.

排查建议 #

• 指定订阅上下文：Runbook默认可能未切换到目标Key Vault所在订阅，添加Set-AzContext -SubscriptionId <订阅ID>命令，确保上下文与Key Vault所在订阅一致
• 验证托管身份的订阅级权限：确认自动化账户的托管身份拥有目标订阅的Reader权限，避免因订阅级权限不足导致无法定位Key Vault资源
• 检查Key Vault网络规则：若Key Vault配置了防火墙或虚拟网络规则，需将自动化账户的托管身份加入允许列表，或启用“允许受信任的Microsoft服务访问此保管库”选项
• 确认证书名称正确性：尝试执行Get-AzKeyVaultCertificate -VaultName $vaultName列出所有证书，确认目标证书名称拼写、版本是否正确
• 降级Az.KeyVault模块：当前使用的Az.KeyVault 4.8.0可能存在兼容性问题，尝试降级到4.7.0或更低稳定版本测试
• 启用详细调试日志：在Runbook开头添加$DebugPreference = 'Continue'，执行命令后查看更详细的请求日志，确认请求是否正常发送到Key Vault服务

UI问题反馈渠道 #

可通过以下方式反馈Azure Runtime环境UI故障：

• Azure门户右上角“帮助 + 支持” -> “新建支持请求”，选择“自动化”服务类别提交问题
• 进入Azure反馈论坛（可通过Azure门户搜索“反馈”入口访问）提交UI问题

内容的提问来源于stack exchange，提问作者DrusePstrago