为Key Vault访问策略分配用户托管标识Object ID时遇UUID错误

问题场景 #

尝试将用户托管标识的Object ID配置到Key Vault访问策略中，赋予该标识对Key Vault证书的Get和List权限，编写Terraform代码后运行报错。

原代码 #

# 用户托管身份
resource "azurerm_user_assigned_identity" "user_assigned_identity" {
  location            = "west europe"
  name                = "Identity_Name"
  resource_group_name = "Resource_Group_Name"
}

# Key Vault访问策略
data "azurerm_client_config" "example" {
}

resource "azurerm_key_vault_access_policy" "access_policy" {
  key_vault_id = "000000-000000-000000-000000"
  tenant_id    = data.azurerm_client_config.example.tenant_id
  object_id    = azurerm_user_assigned_identity.user_assigned_identity.id

  certificate_permissions = [
    "Get","List",
  ]
}

错误信息 #

Error: expected "object_id" to be a valid UUID, got /subscriptions/0000000-0000-0000-0000-0000000000/resourceGroups/Resource_Group_Name/providers/Microsoft.ManagedIdentity/userAssignedIdentities/Identity_Name

解决方法 #

报错原因是object_id字段需要的是托管标识的对象UUID，但代码中传入的是托管标识的资源ID（id属性）。只需将object_id的值替换为托管标识的principal_id属性即可：

修正后代码 #

# 用户托管身份
resource "azurerm_user_assigned_identity" "user_assigned_identity" {
  location            = "west europe"
  name                = "Identity_Name"
  resource_group_name = "Resource_Group_Name"
}

# Key Vault访问策略
data "azurerm_client_config" "example" {
}

resource "azurerm_key_vault_access_policy" "access_policy" {
  key_vault_id = "000000-000000-000000-000000"
  tenant_id    = data.azurerm_client_config.example.tenant_id
  # 替换为principal_id获取托管标识的对象UUID
  object_id    = azurerm_user_assigned_identity.user_assigned_identity.principal_id

  certificate_permissions = [
    "Get","List",
  ]
}

principal_id是azurerm_user_assigned_identity资源的内置属性，对应托管标识的Object ID，符合Key Vault访问策略对object_id字段的UUID格式要求。

内容的提问来源于stack exchange，提问作者Kalin-the-Builder