从Bicep模板向PowerShell DSC脚本传安全参数时遇范围错误

错误“Value does not fall within the expected range”的核心原因是Log Analytics Agent的AddCloudWorkspace方法需要接收字符串格式的工作区密钥，但当前DSC脚本传递的是PSCredential对象，同时代码中存在几处参数处理和引用的错误。以下是具体修正步骤：

1. 修正DSC脚本的参数与逻辑 #

• 将workspaceKey1的参数类型从PSCredential改为string，因为AddCloudWorkspace第二个参数直接需要密钥字符串。
• 删除重复创建PSCredential的冗余代码。
• 修正TestScript中的变量引用错误（$Using:workspaceId改为$Using:workspaceId1）。

修正后的DSC脚本：

Configuration MmaMultihoming
{
    Param ( 
        [string] $workspaceId1,
        [string] $workspaceKey1
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration;
    Import-DscResource -ModuleName xPSDesiredStateConfiguration;

    Node localhost {
        Script ConfigureWorkspace
        {
            SetScript =
            {
                $workspaceId = $Using:workspaceId1;
                $workspaceKey = $Using:workspaceKey1;
                $mma = New-Object -ComObject 'AgentConfigManager.MgmtSvcCfg';
                # 直接传递字符串密钥
                $mma.AddCloudWorkspace($workspaceId, $workspaceKey); 
                $mma.ReloadConfiguration();
            }

            TestScript = { 
                # 修正变量引用为workspaceId1
                Test-Path "HKLM:\SYSTEM\ControlSet001\Services\HealthService\Parameters\Service Connector Services\Log Analytics - $($Using:workspaceId1)"
            }
            GetScript = { 
                @{ Result = (Get-ChildItem "HKLM:\SYSTEM\ControlSet001\Services\HealthService\Parameters\Service Connector Services")} 
            }
        }
    }
}

2. 修正Bicep中的参数传递 #

• 调整protectedSettings里的configurationArguments，直接传递字符串格式的workspaceKey1，不再用PSCredential结构。
• 注意：Bicep中kv.getSecret()本身返回安全值，无需额外添加@secure()修饰参数。

修正后的Bicep代码片段：

param keyvaultName string = 'keyvault'
param kvResourceGroup string = 'keyvault-rg'
param workspaceId1 string
# 直接从密钥库获取secret
param workspaceKey1 string = kv.getSecret('workspaceKey1')

resource kv 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  name: keyvaultName
  scope: resourceGroup(kvResourceGroup )
}

resource DSC_LogAnalytics 'Microsoft.Compute/virtualMachines/extensions@2022-08-01' = {
  parent: vm1
  name: 'Microsoft.Powershell.DSC'
  location: location
  properties: {
    publisher: 'Microsoft.PowerShell'
    type: 'DSC'
    typeHandlerVersion: '2.77'
    autoUpgradeMinorVersion: true
    settings: {
      wmfVersion: 'latest'
      configuration: {
        url: dscScript
        script: 'dsc.ps1'
        function: 'MmaMultihoming'
      }
      configurationArguments: {
        workspaceId1: workspaceId1
      }
      privacy: {
        datacollection: 'enable'
      }
      advancedOptions: {
        forcePullAndApply: false
      }
    }
    protectedSettings: {
      configurationArguments: {
        # 直接传递密钥字符串，不再使用PSCredential结构
        workspaceKey1: workspaceKey1
      }
      configurationUrlSasToken: SaaStoken
    }
  }
}

额外验证点 #

• 确认密钥库的workspaceKey1 secret值是正确的Log Analytics工作区主键/次键，没有多余的空格或换行。
• 确保虚拟机有访问密钥库的权限（通过VM系统身份或访问策略），避免secret获取失败导致空值传递。

内容的提问来源于stack exchange，提问作者Adrian