在Bicep中配置Key Vault访问策略用循环遇类型转换错误求助

编写Bicep代码为KeyVault配置访问策略，分别给用户和应用数组设置不同的密钥权限，代码如下：

param keyVault_name string
param webapp_principleId string
param functionsApp_principleId string
param location string
param user_id string

var userPermission = [
  user_id 
]

var appPermission = [
  webapp_principleId
  functionsApp_principleId
]

resource keyVault_resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: keyVault_name
  location: location
  properties:{
    accessPolicies:[[for (app, index) in appPermission: {
      objectId: app
      tenantId: tenant().tenantId
      permissions: {
        secrets: [ 'get', 'list' ]
      }
    }], [for (user, index) in userPermission: {
      objectId: user
      tenantId: tenant().tenantId
      permissions: {
        secrets: [ 'get', 'list', 'set' ]
      }
    }]]
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenant().tenantId
  }
}

运行代码时出现以下错误：

The enclosing array expected an item of type AccessPolicyEntry, but the provided item was of type object[]. bicep(BCP034)

解决方案 #

不需要类型转换，问题根源是accessPolicies字段的写法错误：你将两个循环生成的数组嵌套进了外层数组，导致最终是二维数组，但KeyVault的accessPolicies要求的是一维的AccessPolicyEntry对象数组。

只需用Bicep的数组展开运算符（...）将两个数组合并为一个一维数组即可，修改后的代码如下：

param keyVault_name string
param webapp_principleId string
param functionsApp_principleId string
param location string
param user_id string

var userPermission = [
  user_id 
]

var appPermission = [
  webapp_principleId
  functionsApp_principleId
]

resource keyVault_resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: keyVault_name
  location: location
  properties:{
    accessPolicies: [
      ...[for (app, index) in appPermission: {
        objectId: app
        tenantId: tenant().tenantId
        permissions: {
          secrets: [ 'get', 'list' ]
        }
      }]
      ...[for (user, index) in userPermission: {
        objectId: user
        tenantId: tenant().tenantId
        permissions: {
          secrets: [ 'get', 'list', 'set' ]
        }
      }]
    ]
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenant().tenantId
  }
}

数组展开运算符...会将每个循环生成的数组中的元素平铺到外层数组中，最终得到符合要求的一维AccessPolicyEntry对象数组。

内容的提问来源于stack exchange，提问作者H. Pauwelyn