使用Bicep模块在Key Vault创建密钥时触发Bad Request错误

问题背景 #

原本在创建Key Vault时同步生成CMK的Bicep代码可正常运行，但将密钥创建逻辑拆分为create_cmk_in_kv.bicep模块后，部署返回失败：
The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.
原始错误仅显示Bad Request，无详细信息：

{
  "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
  "details": [
    {
      "code": "BadRequest",
      "message": ""
    }
  ]
}

相关代码 #

原成功代码（Key Vault同层级创建密钥） #

// 创建存储账户密钥
resource storageAccountCmkKey 'Microsoft.KeyVault/vaults/keys@2023-07-01' = {
  parent: keyVault
  name: storageAccountCmkKeyName
  properties: {
    kty: 'RSA' // CMK仅支持RSA密钥
    keySize: 4096
    attributes: {
      enabled: true
      exportable: false
    }
    rotationPolicy: {
      lifetimeActions: [
        {
          trigger: {
            timeAfterCreate: 'P5M' // 5个月
          }
          action: {
            type: 'rotate'
          }
        }
        {
          trigger: {
            timeBeforeExpiry: 'P1M' // 1个月
          }
          action: {
            type: 'notify'
          }
        }
      ]
      attributes: {
        expiryTime: 'P6M' // 6个月
      }
    }
  }
}

main.bicep模块调用代码 #

module Create_CMK './modules/create_cmk_in_kv.bicep' = {
  name:'Create_CMK'
  scope: resourceGroup('rg-inf-auto-dev-001')
  params: {
    keyName: cmk_key_name
    keyVaultname: keyvault.keyVaultName
    keyOps: cmk.keyOps
    keyType: cmk.keyType
    versionExpiryDays: cmk.versionExpiryDays
    rotateBeforeExpiry: cmk.rotateBeforeExpiry
    keySize: cmk.keySize
  }
  dependsOn:[createKeyVault]
}

create_cmk_in_kv.bicep模块代码 #

@description('Key Vault名称')
param keyVaultname string

@description('密钥名称')
param keyName string

@description('允许的密钥操作数组')
param keyOps array = [
  'sign'
  'verify'
  'encrypt'
  'decrypt'
  'wrapKey'
  'unwrapKey'
]

@description('密钥类型')
param keyType string = 'RSA'

@description('密钥大小')
param keySize int = 3072

@description('密钥版本过期天数')
param versionExpiryDays int = 180

@description('过期前自动轮换天数')
param rotateBeforeExpiry int = 30

resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
  name: keyVaultname
}

resource cmkKey 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
  parent: keyVault
  name: keyName
  properties: {
    keyOps: keyOps
    attributes: {
      enabled: true
    }
    keySize: keySize
    kty: keyType

    rotationPolicy:{
      attributes: { 
        expiryTime: 'P${versionExpiryDays}D'
      }
      lifetimeActions: [
        {
          action: {
            type: 'Rotate'
          }
          trigger: {
            timeBeforeExpiry: 'P${rotateBeforeExpiry}D'
          }
        }
      ]
    }
  }
}

问题排查与修复方案 #

1. API版本不一致 #

原代码使用Microsoft.KeyVault/vaults/keys@2023-07-01，但模块中使用@2023-02-01，部分属性在旧版本中格式要求或支持性不同。需将模块中的API版本统一为2023-07-01。

2. 轮换策略格式与属性缺失 #

• 轮换策略的action.type需为小写：原代码用rotate，模块中用大写Rotate，不符合ARM API要求，需统一为小写。
• 模块中缺失exportable: false属性，需补充到attributes节点中。
• 确认expiryTime格式符合ISO 8601标准（如P180D代表180天）。

3. 模块作用域优化 #

若Key Vault与模块在同一资源组，可移除模块的显式scope配置，让模块继承父模板作用域，避免跨作用域依赖潜在问题。

修复后的模块代码示例 #

@description('Key Vault名称')
param keyVaultname string

@description('密钥名称')
param keyName string

@description('允许的密钥操作数组')
param keyOps array = [
  'sign'
  'verify'
  'encrypt'
  'decrypt'
  'wrapKey'
  'unwrapKey'
]

@description('密钥类型')
param keyType string = 'RSA'

@description('密钥大小')
param keySize int = 3072

@description('密钥版本过期天数')
param versionExpiryDays int = 180

@description('过期前自动轮换天数')
param rotateBeforeExpiry int = 30

resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
  name: keyVaultname
}

resource cmkKey 'Microsoft.KeyVault/vaults/keys@2023-07-01' = {
  parent: keyVault
  name: keyName
  properties: {
    kty: keyType
    keySize: keySize
    keyOps: keyOps
    attributes: {
      enabled: true
      exportable: false
    }
    rotationPolicy: {
      attributes: {
        expiryTime: 'P${versionExpiryDays}D'
      }
      lifetimeActions: [
        {
          trigger: {
            timeBeforeExpiry: 'P${rotateBeforeExpiry}D'
          }
          action: {
            type: 'rotate'
          }
        }
      ]
    }
  }
}

4. 额外检查点 #

• 验证传入模块的参数合法性：比如keyType必须是RSA或RSA-HSM（符合CMK要求），keyOps数组值需为Key Vault支持的操作类型。
• 确认部署主体拥有Key Vault的keys/create权限，否则无法创建密钥。

内容的提问来源于stack exchange，提问作者learner