咨询基于Terraform安全部署Azure Event Hub的准则及示例代码

核心安全原则与对应实现策略 #

1. 优先使用Azure AD身份验证，禁用SAS密钥 #

• 避免使用共享访问签名（SAS）密钥，改用Azure AD角色授权，减少密钥泄露风险。仅在兼容旧系统的场景下保留SAS，且定期轮换密钥。
• Terraform代码片段（角色分配）：

resource "azurerm_role_assignment" "event_hub_data_sender" {
  scope                = azurerm_event_hub.event_hub.id
  role_definition_name = "Azure Event Hubs Data Sender"
  principal_id         = var.service_principal_object_id // 替换为你的服务主体Object ID
}

2. 启用网络隔离，限制访问来源 #

• 配置虚拟网络服务端点，仅允许指定VNet内的资源访问Event Hub；同时设置IP防火墙规则，放行必要的公网IP（如果需要）。拒绝所有未授权的网络访问。
• Terraform代码片段（网络配置）：

resource "azurerm_event_hub_namespace" "event_hub_ns" {
  name                = "secure-event-hub-ns"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "Standard" // 网络隔离需要Standard或Premium SKU

  # 禁用公共网络访问，仅允许VNet和IP规则
  public_network_access_enabled = false

  virtual_network_rule {
    subnet_id                     = azurerm_subnet.event_hub_subnet.id
    ignore_missing_vnet_service_endpoint = false
  }

  ip_filter_rule {
    name               = "allow-specific-ip"
    ip_mask            = "192.168.1.0/24" // 替换为需要放行的IP段
    action             = "Allow"
  }
}

3. 强化数据加密（静态+传输） #

• 静态加密默认使用Azure托管密钥，可配置客户管理密钥（CMK）将加密密钥控制权掌握在自己手中；传输强制使用TLS 1.2及以上版本。
• Terraform代码片段（CMK加密配置）：

resource "azurerm_event_hub_namespace" "event_hub_ns" {
  # 其他基础配置...

  encryption {
    key_vault_key_id = azurerm_key_vault_key.event_hub_key.id
    key_source       = "Microsoft.KeyVault"
  }
}

resource "azurerm_key_vault_key" "event_hub_key" {
  name         = "event-hub-encryption-key"
  key_vault_id = azurerm_key_vault.kv.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
}

4. 开启诊断日志与监控 #

• 收集Event Hub的访问日志、指标，发送到Log Analytics工作区，用于审计异常访问、排查安全事件。
• Terraform代码片段（诊断设置）：

resource "azurerm_monitor_diagnostic_setting" "event_hub_diag" {
  name               = "event-hub-diagnostic-setting"
  target_resource_id = azurerm_event_hub_namespace.event_hub_ns.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.law.id

  log {
    category = "ArchiveLogs"
    enabled  = true

    retention_policy {
      enabled = true
      days    = 30
    }
  }

  log {
    category = "OperationalLogs"
    enabled  = true

    retention_policy {
      enabled = true
      days    = 30
    }
  }

  metric {
    category = "AllMetrics"
    enabled  = true

    retention_policy {
      enabled = true
      days    = 30
    }
  }
}

5. 遵循最小权限原则 #

• 为访问Event Hub的服务主体或用户分配最窄的角色权限：比如仅给数据发送者分配Azure Event Hubs Data Sender角色，给接收者分配Azure Event Hubs Data Receiver角色，避免使用高权限角色（如Owner、Contributor）。

完整Terraform示例代码 #

# 配置Azure Provider
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# 资源组
resource "azurerm_resource_group" "rg" {
  name     = "secure-event-hub-rg"
  location = "East US"
}

# 虚拟网络与子网（用于VNet服务端点）
resource "azurerm_virtual_network" "vnet" {
  name                = "event-hub-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_subnet" "event_hub_subnet" {
  name                 = "event-hub-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]

  # 启用Event Hub服务端点
  service_endpoints = ["Microsoft.EventHub"]
}

# Key Vault（用于CMK加密）
resource "azurerm_key_vault" "kv" {
  name                       = "event-hub-kv-${random_string.suffix.result}"
  location                   = azurerm_resource_group.rg.location
  resource_group_name        = azurerm_resource_group.rg.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days = 7
  purge_protection_enabled   = true

  sku_name = "standard"

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    key_permissions = [
      "Get", "List", "Create", "Delete", "Recover", "Backup", "Restore", "Decrypt", "Encrypt", "Sign", "Verify", "WrapKey", "UnwrapKey"
    ]
  }

  # 允许Event Hub服务访问Key Vault
  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_event_hub_namespace.event_hub_ns.identity[0].principal_id

    key_permissions = [
      "Get", "WrapKey", "UnwrapKey"
    ]
  }
}

resource "random_string" "suffix" {
  length  = 5
  special = false
  upper   = false
}

data "azurerm_client_config" "current" {}

# Event Hub命名空间
resource "azurerm_event_hub_namespace" "event_hub_ns" {
  name                = "secure-event-hub-ns-${random_string.suffix.result}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "Premium" // Premium支持CMK和更高级的网络隔离
  capacity            = 1

  public_network_access_enabled = false
  zone_redundant                = true

  # 启用系统分配的托管身份，用于访问Key Vault
  identity {
    type = "SystemAssigned"
  }

  virtual_network_rule {
    subnet_id                     = azurerm_subnet.event_hub_subnet.id
    ignore_missing_vnet_service_endpoint = false
  }

  ip_filter_rule {
    name               = "allow-office-ip"
    ip_mask            = "192.168.2.0/24"
    action             = "Allow"
  }

  encryption {
    key_vault_key_id = azurerm_key_vault_key.event_hub_key.id
    key_source       = "Microsoft.KeyVault"
  }
}

# 加密密钥
resource "azurerm_key_vault_key" "event_hub_key" {
  name         = "event-hub-encryption-key"
  key_vault_id = azurerm_key_vault.kv.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
}

# Event Hub实例
resource "azurerm_event_hub" "event_hub" {
  name                = "secure-event-hub"
  namespace_name      = azurerm_event_hub_namespace.event_hub_ns.name
  resource_group_name = azurerm_resource_group.rg.name
  partition_count     = 4
  message_retention   = 7
}

# 给服务主体分配数据发送者角色
resource "azurerm_role_assignment" "event_hub_data_sender" {
  scope                = azurerm_event_hub.event_hub.id
  role_definition_name = "Azure Event Hubs Data Sender"
  principal_id         = var.service_principal_object_id // 需提前定义这个变量
}

# Log Analytics工作区
resource "azurerm_log_analytics_workspace" "law" {
  name                = "event-hub-law-${random_string.suffix.result}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
}

# 诊断设置
resource "azurerm_monitor_diagnostic_setting" "event_hub_diag" {
  name               = "event-hub-diagnostic-setting"
  target_resource_id = azurerm_event_hub_namespace.event_hub_ns.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.law.id

  log {
    category = "ArchiveLogs"
    enabled  = true

    retention_policy {
      enabled = true
      days    = 30
    }
  }

  log {
    category = "OperationalLogs"
    enabled  = true

    retention_policy {
      enabled = true
      days    = 30
    }
  }

  metric {
    category = "AllMetrics"
    enabled  = true

    retention_policy {
      enabled = true
      days    = 30
    }
  }
}

# 变量定义
variable "service_principal_object_id" {
  type        = string
  description = "Object ID of the service principal that needs Event Hub data access"
}

内容的提问来源于stack exchange，提问作者Geetha Hassan