Azure Logic Apps参数窗口显示Key Vault机密值，如何隐藏？

从Azure Key Vault中获取机密值，但对应的secure string在Azure Logic Apps的参数窗口中可见，需要将其从该窗口隐藏。相关配置文件及参数窗口截图如下：

dev.logic.parameters.json 文件 #

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "logicAppName": {
      "value": "gaf-ir-dev-publisheventtosfplatform-logicapp"
    },
    "salesforce-client-secret": {
      "reference": {
        "keyVault": {
          "id": "/subscriptions/42187cc7-b2ae-423a-9039-00298be79cdf/resourceGroups/ir-dev-use-rg/providers/Microsoft.KeyVault/vaults/ir-dev-use-kv"
        },
        "secretName": "SalesforceClientSecret"
      }
    }
  }
}

LogicApp.json 文件 #

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "logicAppName": {
      "type": "string",
      "minLength": 1,
      "maxLength": 80,
      "metadata": {
        "description": "Name of the Logic App."
      }
    },
    
    "salesforce-client-secret": {
      "type": "securestring",
      "metadata": {
        "description": "salesforce-client-secret"
      }
    }
  },
  "variables": {},
  "resources": [
    {
      "name": "[parameters('logicAppName')]",
      "type": "Microsoft.Logic/workflows",
      "location": "[parameters('logicAppLocation')]",
      "tags": {
        "displayName": "LogicApp"
      },
      "apiVersion": "2016-06-01",
      "properties": {
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
          "actions": "...",
          "parameters": {
            "salesforce-client-secret": {
              "type": "securestring",
              "defaultValue": "[parameters('salesforce-client-secret')]"
            }
          },
          "triggers": {
            "manual": {
              "type": "Request",
              "kind": "Http",
              "inputs": {
                "schema": {}
              }
            }
          },
          "contentVersion": "1.0.0.0",
          "outputs": {}
        },
        "parameters": {}
      }
    }
  ],
  "outputs": {}
}

参数窗口截图 #

如图所示，机密值显示在默认值文本框中，不符合预期，需隐藏。

问题出在LogicApp.json的工作流定义中，直接将ARM参数赋值给了工作流参数的defaultValue，导致部署后具体机密值被填充到默认值字段，从而在参数窗口暴露。

修改配置的核心思路是：让工作流参数通过顶层parameters节点引用Key Vault机密，而非在工作流定义中设置默认值。

修改后的LogicApp.json关键片段 #

"resources": [
    {
      "name": "[parameters('logicAppName')]",
      "type": "Microsoft.Logic/workflows",
      "location": "[parameters('logicAppLocation')]",
      "tags": {
        "displayName": "LogicApp"
      },
      "apiVersion": "2016-06-01",
      "properties": {
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
          "actions": "...",
          "parameters": {
            "salesforce-client-secret": {
              "type": "securestring"
              // 移除 defaultValue 配置
            }
          },
          "triggers": {
            "manual": {
              "type": "Request",
              "kind": "Http",
              "inputs": {
                "schema": {}
              }
            }
          },
          "contentVersion": "1.0.0.0",
          "outputs": {}
        },
        // 新增：在工作流顶层parameters节点配置Key Vault引用
        "parameters": {
          "salesforce-client-secret": {
            "value": "[parameters('salesforce-client-secret')]"
          }
        }
      }
    }
  ]

关键修改说明 #

1. 删除工作流定义中的defaultValue：避免将机密值作为默认值存储在工作流定义里，防止明文暴露。
2. 配置顶层parameters节点：在工作流的properties.parameters下添加参数映射，将ARM模板中的Key Vault引用传递给工作流参数。这样部署后，工作流会直接从Key Vault获取机密，参数窗口不会显示具体值。

权限验证 #

确保Logic App的托管标识（或服务主体）拥有目标Key Vault的Secret Get权限，否则会出现机密获取失败的问题。

内容的提问来源于stack exchange，提问作者shujaat siddiqui