Bicep模板中如何将多个WebApp的ManagedID添加到KeyVault访问策略

步骤1：调整KeyVault模块参数与访问策略逻辑 #

原有KeyVault模块的objectId为单值字符串，不支持多标识场景，先修改模块内的参数与访问策略配置：

// 替换原有单值objectId参数定义
param objectIds array // 用于接收多个托管标识ID的数组
param tenantId string

如果你的KeyVault是在模块内新建的，直接在KV资源的accessPolicies属性中循环生成多组策略即可：

resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' = {
  name: keyVaultName
  properties: {
    tenantId: tenantId
    sku: {
      family: skuFamily
      name: skuName
    }
    // 其余原有KV配置保持不变
    accessPolicies: [for objectId in objectIds: {
      tenantId: tenantId
      objectId: objectId
      permissions: {
        secrets: secretsPermissions // 沿用你原有定义的密钥权限
        keys: keyPermissions // 沿用你原有定义的密钥权限
      }
    }]
  }
}

步骤2：批量收集WebApp的托管标识ID #

在调用WebApp循环模块的父模板中，将所有WebApp模块输出的托管标识ID收集为数组：

// 批量提取所有WebApp的托管标识ID
var webAppPrincipalIds = [for i in range(0, length(webAppSettings.webApps)): AppService[i].outputs.usid]

确保你的Azure.App.Service.template.bicep模块中保留了托管标识的输出定义即可：

// AppService模块内的输出保持原有定义不变
output usid string = AppServices.identity.principalId

步骤3：调整KeyVault模块的调用参数与依赖 #

修改原有KeyVault模块的调用代码，新增依赖确保WebApp先完成部署，再传入收集好的标识数组：

module ciKeyVault '你的KeyVault模块路径' = {
  name: 'ciKeyVault'
  dependsOn: [
    AppService // 依赖所有WebApp完成部署，才能拿到完整的标识ID数组
  ]
  params: {
    keyVaultName: keyVaultName
    aclBypass: keyVaultSettings.aclBypass
    aclDefaultAction: keyVaultSettings.aclDefaultAction
    enabledForDeployment: keyVaultSettings.enabledForDeployment
    enabledForDiskEncryption: keyVaultSettings.enabledForDiskEncryption
    enabledForTemplateDeployment: keyVaultSettings.enabledForTemplateDeployment
    keyPermissions: keyVaultSettings.keyPermissions
    keyVaultSettings: keyVaultSettings
    secretsPermissions: keyVaultSettings.secretsPermissions
    skuFamily: keyVaultSettings.skuFamily
    skuName: keyVaultSettings.skuName
    tenantId: subscription().tenantId
    // 替换原有单值objectId参数
    objectIds: webAppPrincipalIds
  }
}

可选方案（无需修改原有KV模块） #

如果你不想改动已封装好的KeyVault模块，可以在父模板中单独循环添加访问策略：

// 引用已创建完成的KeyVault
resource existingKeyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
  name: keyVaultName
  dependsOn: [
    ciKeyVault
    AppService
  ]
}

// 循环为每个WebApp添加访问策略
resource addAccessPolicies 'Microsoft.KeyVault/vaults/accessPolicies@2023-02-01' = [for (principalId, index) in webAppPrincipalIds: {
  name: '${existingKeyVault.name}/add'
  properties: {
    accessPolicies: [
      {
        tenantId: subscription().tenantId
        objectId: principalId
        permissions: {
          secrets: keyVaultSettings.secretsPermissions
          keys: keyVaultSettings.keyPermissions
        }
      }
    ]
  }
}]

内容的提问来源于stack exchange，提问作者user11455801