如何通过ARM模板将Key Vault部署为Azure App Service环境变量

1. 模板核心代码 #

修改原有ARM模板，添加Key Vault相关参数，并将应用设置改为引用Key Vault密钥的格式：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "webAppName": {
      "type": "string",
      "metadata": {
        "description": "App Service实例名称"
      }
    },
    "keyVaultName": {
      "type": "string",
      "metadata": {
        "description": "目标Key Vault名称"
      }
    },
    // 按需添加对应Key Vault中的密钥名称参数
    "dbConnSecretName": {
      "type": "string",
      "metadata": {
        "description": "数据库连接字符串对应的Key Vault密钥名"
      }
    },
    "apiKeySecretName": {
      "type": "string",
      "metadata": {
        "description": "API密钥对应的Key Vault密钥名"
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2022-03-01",
      "name": "[parameters('webAppName')]",
      "location": "[resourceGroup().location]",
      // 启用系统分配MSI，用于App Service访问Key Vault
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "siteConfig": {
          "appSettings": [
            {
              "name": "DbConnectionString",
              "value": "[concat('@Microsoft.KeyVault(SecretUri=https://', parameters('keyVaultName'), '.vault.azure.net/secrets/', parameters('dbConnSecretName'), '/')]"
            },
            {
              "name": "ApiKey",
              "value": "[concat('@Microsoft.KeyVault(SecretUri=https://', parameters('keyVaultName'), '.vault.azure.net/secrets/', parameters('apiKeySecretName'), '/')]"
            }
            // 可继续添加更多引用Key Vault的应用设置项
          ]
        }
      }
    }
  ]
}

2. 参数文件（csmParametersFile）示例 #

创建parameters.json文件存储固定参数值，动态参数可在YAML中通过overrideParameters覆盖：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "webAppName": {
      "value": "my-demo-webapp"
    },
    "keyVaultName": {
      "value": "my-demo-keyvault"
    },
    "dbConnSecretName": {
      "value": "DbConnectionString"
    },
    "apiKeySecretName": {
      "value": "ServiceApiKey"
    }
  }
}

在部署任务中保留csmParametersFile和overrideParameters的用法，传入Azure DevOps库中的Key Vault相关变量：

steps:
- task: AzureResourceManagerTemplateDeployment@3
  displayName: '部署App Service及Key Vault引用配置'
  inputs:
    deploymentScope: 'Resource Group'
    azureResourceManagerConnection: '<你的Azure服务连接名称>'
    subscriptionId: '<目标订阅ID>'
    action: 'Create Or Update Resource Group'
    resourceGroupName: '<目标资源组名称>'
    location: '<部署区域>'
    templateLocation: 'Linked artifact'
    csmFile: './templates/webapp-keyvault-template.json'
    csmParametersFile: './templates/parameters.json'
    # 用overrideParameters覆盖参数文件中的动态值，从Azure DevOps库拉取变量
    overrideParameters: >
      -webAppName $(WebAppName)
      -keyVaultName $(KeyVaultNameFromLibrary)
      -dbConnSecretName $(DbSecretName)
    deploymentMode: 'Incremental'

• App Service MSI权限：在Key Vault的「访问策略」中，添加App Service的系统分配身份，授予「秘密-读取」权限，确保App Service能拉取Key Vault中的密钥。
• Azure DevOps服务主体权限：给管道使用的服务主体添加Key Vault的「列表」权限，确保ARM模板部署时能验证密钥路径的有效性。

内容的提问来源于stack exchange，提问作者Ahsan Ullah Khan