如何获取现有App Service的系统分配托管标识配置Key Vault访问策略？

场景与代码 #

需求是为已启用系统分配托管标识的现有App Service创建Key Vault访问策略，编写的Bicep代码如下：

resource apiWeb 'Microsoft.Web/sites@2022-03-01' existing = {
  name: apiWebAppName
}

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: keyVaultName
  location: location
  tags: tags
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenantId
    accessPolicies: [
      {
        tenantId: tenantId
        objectId: apiWeb.identity.principalId
        permissions: {
          secrets: [
            'get'
            'list'
          ]
        }
      }
    ]
  }
}

遇到的错误 #

1. 部署时收到错误：

{
    "status": "Failed",
    "error": {
        "code": "InvalidTemplate",
        "message": "Unable to process template language expressions for resource '/subscriptions/xyz/resourceGroups/rg/providers/Microsoft.KeyVault/vaults/kv' at line '47' and column '5'. 'The language expression property 'identity' doesn't exist, available properties are 'apiVersion, location, tags, kind, properties, condition, deploymentResourceLineInfo, existing, isConditionTrue, subscriptionId, resourceGroupName, scope, resourceId, referenceApiVersion, isTemplateResource, isAction, provisioningOperation'.'",
        "additionalInfo": [
            {
                "type": "TemplateViolation",
                "info": {
                    "lineNumber": 47,
                    "linePosition": 5,
                    "path": ""
                }
            }
        ]
    }
}

2. 尝试在existing资源声明中添加identity块时，出现编译错误：

The property "identity" cannot be used in an existing resource declaration.bicep(BCP173)

解决方案 #

错误核心原因：使用existing声明现有资源时，Bicep默认仅获取资源的基础元数据，不会自动加载identity这类扩展属性。要正确获取现有Web App的托管标识，需通过reference函数显式获取资源的完整属性。

修改Key Vault访问策略中的objectId字段，替换为：

objectId: reference(apiWeb.id, apiWeb.apiVersion).identity.principalId

完整修改后的代码：

resource apiWeb 'Microsoft.Web/sites@2022-03-01' existing = {
  name: apiWebAppName
}

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: keyVaultName
  location: location
  tags: tags
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenantId
    accessPolicies: [
      {
        tenantId: tenantId
        objectId: reference(apiWeb.id, apiWeb.apiVersion).identity.principalId
        permissions: {
          secrets: [
            'get'
            'list'
          ]
        }
      }
    ]
  }
}

注意事项 #

• 确保目标Web App已启用系统分配托管标识，否则identity.principalId会返回null，导致部署失败。
• reference函数会在部署时实时获取资源的最新属性，确保标识信息准确。

内容的提问来源于stack exchange，提问作者michasaucer