Azure PostgreSQL备份Vault遇Key Vault读取权限缺失错误求助

在Azure中通过Terraform配置PostgreSQL数据库的备份Vault，已部署以下资源：

备份Vault资源 #

resource "azurerm_data_protection_backup_vault" "abc-backup-vault" {
  name                = "abc-backup-vault"
  resource_group_name = "rg-al-prod-we"
  location            = "West Europe"
  datastore_type      = "VaultStore"
  redundancy          = "LocallyRedundant"

  identity {
    type = "SystemAssigned"
  }
}

备份策略 #

resource "azurerm_data_protection_backup_policy_postgresql" "abc-backup-vault-policy" {
  name                            = "abc-backup-vault-policy"
  resource_group_name             = "rg-al-prod-we"
  vault_name                      = azurerm_data_protection_backup_vault.abc-backup-vault.name
  backup_repeating_time_intervals = [
                            "R/2023-08-07T01:00:00+00:00/P1W",
                            "R/2023-08-08T01:00:00+00:00/P1W",
                            "R/2023-08-02T01:00:00+00:00/P1W",
                            "R/2023-08-03T01:00:00+00:00/P1W",
                            "R/2023-08-04T01:00:00+00:00/P1W"
                        ]
  default_retention_duration      = "P4M"
}

备份实例 #

resource "azurerm_data_protection_backup_instance_postgresql" "abc-backup-vault-backup-instance" {
  name                                    = "abc-backup-vault-backup-instance"
  location                                = "West Europe"
  vault_id                                = azurerm_data_protection_backup_vault.abc-backup-vault.id
  database_id                             = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg-al-prod-we/providers/Microsoft.DBforPostgreSQL/servers/sqldb-abc-prod.postgres.database.azure.com/databases/abcProd"
  backup_policy_id                        = azurerm_data_protection_backup_policy_postgresql.abc-backup-vault-policy.id
  database_credential_key_vault_secret_id = "https://kv-abc-prodction.vault.azure.net/secrets/abc-prod-connectionstring/c80bcd5eaebf4cf9bf8e6d80efc50a92"
}

已手动创建Key Vault并存储数据库连接字符串为Secret，同时部署以下角色分配脚本：

resource "mskadmiralv2_azure_resource_role_assignment" "abc-backup-vault-role" {
  object_id    = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
  product_code = "abc"
  resource_id  = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg-al-prod-we/providers/Microsoft.DBforPostgreSQL/servers/psqldb-abc-prod/"
  role_id      = "5e467623-bb1f-42f4-a55d-6e525e11384b"
}

resource "mskadmiralv2_azure_resource_role_assignment" "abc-key-vault-role" {
  object_id    = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
  product_code = "abc"
  resource_id  = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg_abc-kv-abc-prodction_mkv/providers/Microsoft.KeyVault/vaults/kv-abc-prodction"
  role_id      = "acdd72a7-3385-48ef-bd42-f606fba81ae7"
}

resource "mskadmiralv2_azure_resource_role_assignment" "abc-key-vault-reader-role" {
  object_id    = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
  product_code = "abc"
  resource_id  = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg_abc-kv-abc-prodction_mkv_kv-abc-prodction_mkv/providers/Microsoft.KeyVault/vaults/kv-abc-prodction"
  role_id      = "21090545-7ca7-4776-b22c-e363652d74d2"
}

部署后出现错误：

UserErrorMissingPermissionsOnSecretStore: Missing permissions to read the Key vault secrets.

询问是否仍缺少必要角色，请求协助完成备份Vault配置。

1. 修正Key Vault角色分配的资源ID #

你分配的abc-key-vault-reader-role中resource_id存在资源组名称冗余重复的错误，导致该角色分配无法生效。需将其修正为与abc-key-vault-role一致的正确Key Vault资源ID：

resource "mskadmiralv2_azure_resource_role_assignment" "abc-key-vault-reader-role" {
  object_id    = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
  product_code = "abc"
  # 修正为正确的资源组路径
  resource_id  = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg_abc-kv-abc-prodction_mkv/providers/Microsoft.KeyVault/vaults/kv-abc-prodction"
  role_id      = "21090545-7ca7-4776-b22c-e363652d74d2"
}

2. 确认Key Vault权限模型 #

Azure Key Vault支持两种权限模型，需根据当前模型调整配置：

• RBAC模型：你分配的Key Vault Secrets Officer（acdd72a7-...）和Key Vault Secrets Reader（21090545-...）已包含读取Secret的权限，修正资源ID后即可生效。
• 访问策略模型：RBAC角色不生效，需添加访问策略允许备份Vault的系统身份读取Secret，可通过以下Terraform资源实现：

resource "azurerm_key_vault_access_policy" "backup_vault_secret_access" {
  key_vault_id = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg_abc-kv-abc-prodction_mkv/providers/Microsoft.KeyVault/vaults/kv-abc-prodction"
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id

  secret_permissions = [
    "Get",
  ]
}

3. 验证权限有效性 #

部署修正后的配置后，可通过Azure CLI验证备份Vault的系统身份是否能读取Secret：

# 登录到备份Vault的系统身份
az login --service-principal -u <备份Vault的principal_id> --tenant <你的租户ID>

# 尝试获取目标Secret
az keyvault secret show --name abc-prod-connectionstring --vault-name kv-abc-prodction

4. 补充PostgreSQL角色检查 #

当前错误指向Key Vault，但需确认PostgreSQL服务器的角色分配是否正确：你使用的5e467623-bb1f-42f4-a55d-6e525e11384b是Backup Operator角色，已足够支持备份操作，但需确保resource_id中的服务器名称与备份实例中数据库ID的服务器名称一致（当前脚本中为psqldb-abc-prod，备份实例中为sqldb-abc-prod.postgres.database.azure.com）。

内容的提问来源于stack exchange，提问作者Niranjan