Bicep中跨资源组将Service Bus密钥存入Key Vault的实现方法

需求与问题 #

在Servicebus-rg资源组创建了Service Bus资源，在Eventgrid-rg资源组创建了Event Grid和Key Vault资源，需要将Service Bus主题的共享访问策略（Shared Access Policies）密钥存入Eventgrid-rg中的Key Vault，当前核心问题是如何在Main.bicep中跨资源组引用Service Bus的密钥。

实现步骤 #

1. 修正Service Bus模块的输出 #

在原Service Bus的Bicep文件（servicebus.bicep）中，添加授权规则的ID输出，用于后续跨资源组调用listKeys：

// 原输出基础上新增
output stopicauthruleid string = stopicauthrule.id

2. 整合Event Grid与Key Vault模块 #

将Event Grid和Key Vault的逻辑合并到一个Bicep文件（eventgrid-keyvault.bicep），修正原Key Vault代码中的语法错误（重复资源定义、错误的accessPolicies配置），并添加参数接收Service Bus授权规则的信息：

// Event Grid参数
param evtgriddomainname string
param eventgriddomaintopicname string
param eventsubname string 
param location string 
param servicebustopicid string 
param deliveryattrname string 

// Key Vault及跨资源组密钥获取参数
param keyvaultname string
param tenantid string
param serviceBusAuthRuleId string
param serviceBusAuthRuleApiVersion string = '2021-11-01'

// 获取Event Grid密钥
var evtgridtoken1 = listKeys(eventgrid_domain.id, eventgrid_domain.apiVersion).key1
// 跨资源组调用listKeys获取Service Bus授权规则密钥
var serviceBusSasToken = listKeys(serviceBusAuthRuleId, serviceBusAuthRuleApiVersion).primaryKey

// Event Grid Domain资源
resource eventgrid_domain 'Microsoft.EventGrid/domains@2022-06-15' = {
  name: evtgriddomainname
  location: location
  properties: {
    autoCreateTopicWithFirstSubscription: true
    autoDeleteTopicWithLastSubscription: false
    dataResidencyBoundary: 'WithinGeopair'
    disableLocalAuth: false
    inboundIpRules: []
    inputSchema: 'EventGridSchema'
    publicNetworkAccess: 'Enabled'
  }
  tags: {
    servicename : 'eventgrid-poc'
    env : 'dev'
  }
}

resource eventgrid_domain_topic 'Microsoft.EventGrid/domains/topics@2022-06-15' = {
  name: eventgriddomaintopicname
  parent: eventgrid_domain
}

resource eventgrid_subscription 'Microsoft.EventGrid/domains/topics/eventSubscriptions@2022-06-15' = {
  name: eventsubname
  parent: eventgrid_domain_topic
  properties: {
    destination: {
      endpointType: 'ServiceBusTopic'
      properties: {
        deliveryAttributeMappings: [
          {
            type: 'Static'
            name: deliveryattrname
            properties: {
              isSecret: false
              value: 'not-a-secret-1234'
            }
          }
        ]
        resourceId: servicebustopicid
      }
    }
  }
}

// Key Vault资源
resource keyvault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: keyvaultname
  location: location
  properties: {
    sku: {
      family: 'A'
      name: 'premium'
    }
    tenantId: tenantid
    accessPolicies: [
      {
        permissions: {
          keys: ['all']
          secrets: ['all']
        }
        tenantId: tenantid
        // 替换为有权限管理Key Vault的主体ID（如部署用户/托管标识）
        objectId: 'your-principal-object-id'
      }
    ]
    // 允许模板部署时写入密钥
    enabledForTemplateDeployment: true
  }
}

// 存储Event Grid密钥到Key Vault
resource EventgridSecret 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
  parent: keyvault
  name: 'eventgrid-domain-key'
  properties: {
    value: evtgridtoken1
    attributes: {
      enabled: true
    }
  }
}

// 存储Service Bus密钥到Key Vault
resource serviceBusTopicSecret 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
  parent: keyvault
  name: 'servicebus-topic-sas-key'
  properties: {
    value: serviceBusSasToken
    attributes: {
      enabled: true
    }
  }
}

// 输出信息
output eventgriddomainname string = eventgrid_domain.name
output keyvaultResourceId string = keyvault.id
output serviceBusSecretName string = serviceBusTopicSecret.name

3. Main.bicep 跨资源组部署与引用 #

在Main.bicep中，分别指定两个资源组的部署范围，将Service Bus模块输出的授权规则ID传递给Event Grid + Key Vault模块：

// 部署Servicebus-rg资源组的Service Bus
module serviceBusModule './servicebus.bicep' = {
  name: 'deploy-servicebus'
  scope: resourceGroup('Servicebus-rg')
  params: {
    sbusname: 'your-sbus-name'
    sbustopicname: 'your-topic-name'
    stopicsubscriptionname: 'your-sub-name'
    stopicauthrulename: 'your-auth-rule-name'
    stopicsize: 1024
    location: 'eastus'
  }
}

// 部署Eventgrid-rg资源组的Event Grid和Key Vault
module eventGridKeyVaultModule './eventgrid-keyvault.bicep' = {
  name: 'deploy-eventgrid-keyvault'
  scope: resourceGroup('Eventgrid-rg')
  params: {
    evtgriddomainname: 'your-eg-domain'
    eventgriddomaintopicname: 'your-eg-topic'
    eventsubname: 'your-eg-sub'
    location: 'eastus'
    servicebustopicid: serviceBusModule.outputs.sbustopicid
    deliveryattrname: 'your-delivery-attr'
    keyvaultname: 'your-keyvault-name'
    tenantid: subscription().tenantId
    // 传递Service Bus授权规则ID
    serviceBusAuthRuleId: serviceBusModule.outputs.stopicauthruleid
  }
}

关键注意事项 #

• 权限要求：部署用户需对Servicebus-rg拥有Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys/action权限，才能跨资源组获取密钥。
• Key Vault Access Policies：accessPolicies中的objectId必须是有权限管理Key Vault的主体ID（如部署用户的对象ID、托管标识ID），而非Event Grid或Service Bus的资源ID（原代码中的错误）。
• 模板部署权限：启用Key Vault的enabledForTemplateDeployment属性，允许ARM模板在部署过程中写入密钥。

内容的提问来源于stack exchange，提问作者Phaneendra Allamraju