Terraform部署后如何自动导入Key Vault引用至Logic App环境变量

问题根源 #

你遇到的手动点击“Pull reference values”的问题，本质是应用设置配置时序与Key Vault权限配置时序不匹配：Terraform先配置了Logic App的Key Vault引用型应用设置，但此时Logic App的系统身份还未获得Key Vault的访问权限，导致初始配置时无法自动拉取密钥，需要手动触发同步。

下面提供两种无需手动操作的可行方案：

方案1：用Azure CLI同步命令自动触发拉取 #

直接在Logic App资源中添加local-exec执行Azure官方的同步命令，替代手动点击按钮。该命令专门用于同步应用设置中的Key Vault引用，简洁且官方支持：

resource "azurerm_logic_app_standard" "logic_app" {
  # 保留你原有的所有配置...

  provisioner "local-exec" {
    command = "az webapp config appsettings sync --name ${self.name} --resource-group ${self.resource_group_name}"
    depends_on = [module.mod-azurerm-key-vault-access-policy]
  }
}

• depends_on确保命令在Key Vault访问策略配置完成后执行
• 需保证Terraform运行环境已安装Azure CLI并完成身份验证

方案2：拆分资源配置时序，确保权限先就绪 #

如果不想用provisioner，可以将Logic App的配置拆分为两步：先创建基础资源并配置Key Vault权限，再添加Key Vault引用型应用设置，此时权限已就绪，设置应用时会自动拉取密钥：

# 第一步：创建仅含基础配置的Logic App（不带Key Vault引用）
resource "azurerm_logic_app_standard" "logic_app_base" {
  name                       = "la-${var.project}-${var.region}-${var.environment}"
  resource_group_name        = module.mod-resource-group.name
  location                   = var.location
  storage_account_name       = module.mod-storage-account.name
  storage_account_access_key = module.mod-storage-account.primary_access_key
  app_service_plan_id        = azurerm_service_plan.service_plan.id
  version                    = "~4"
  https_only                 = true

  identity {
    type = "SystemAssigned"
  }

  # 仅配置非Key Vault依赖的应用设置
  app_settings = {
    APPLICATIONINSIGHTS_CONNECTION_STRING = try(module.mod-application-insights.connection_string, null)
    APPINSIGHTS_INSTRUMENTATIONKEY        = try(module.mod-application-insights.instrumentation_key, null)
  }
}

# 第二步：配置Key Vault访问策略（依赖基础Logic App的身份）
module "mod-azurerm-key-vault-access-policy" {
  source                                                    = "git@xxx/Terraform/mod-azurerm-key-vault-access-policy?ref=tags/2.1.0"
  keyvault-id                                               = module.mod-azurerm-key-vault.id
  tenant-id                                                 = data.azurerm_client_config.current.tenant_id
  access_policies = [
    {
      object-id               = azurerm_logic_app_standard.logic_app_base.identity[0].principal_id
      key_permissions         = []
      secret_permissions      = ["Get", "List"]
      certificate_permissions = []
      storage_permissions     = []
    },
    {
      object-id               = var.apim-principal-id
      key_permissions         = []
      secret_permissions      = ["Get", "List"]
      certificate_permissions = []
      storage_permissions     = []
    }
  ]
}

# 第三步：更新Logic App，添加Key Vault引用型应用设置
resource "azurerm_logic_app_standard" "logic_app_final" {
  name                       = azurerm_logic_app_standard.logic_app_base.name
  resource_group_name        = azurerm_logic_app_standard.logic_app_base.resource_group_name
  location                   = azurerm_logic_app_standard.logic_app_base.location
  storage_account_name       = azurerm_logic_app_standard.logic_app_base.storage_account_name
  storage_account_access_key = azurerm_logic_app_standard.logic_app_base.storage_account_access_key
  app_service_plan_id        = azurerm_logic_app_standard.logic_app_base.app_service_plan_id
  version                    = azurerm_logic_app_standard.logic_app_base.version
  https_only                 = azurerm_logic_app_standard.logic_app_base.https_only

  identity {
    type         = "SystemAssigned"
    principal_id = azurerm_logic_app_standard.logic_app_base.identity[0].principal_id
    tenant_id    = azurerm_logic_app_standard.logic_app_base.identity[0].tenant_id
  }

  app_settings = merge(
    azurerm_logic_app_standard.logic_app_base.app_settings,
    {
      apim-oauth-username = "@Microsoft.KeyVault(SecretUri=${module.mod-azurerm-key-vault-secrets.keyvault_secrets_update.apim-oauth-username})"
      # 添加其他Key Vault引用设置...
    }
  )

  depends_on = [module.mod-azurerm-key-vault-access-policy]
}

关键检查点 #

1. 确认Key Vault访问策略已正确赋予Logic App系统身份Get和List的Secret权限
2. 验证SecretUri格式正确：@Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>/<可选版本>)
3. 若使用方案1，需确保Terraform运行环境的Azure CLI已完成身份验证

内容的提问来源于stack exchange，提问作者Xav Sc