使用Terraform为服务主体配置Azure Key Vault访问策略相关问题

前置依赖 #

• 已完成Azure CLI本地登录，或配置好Terraform Azure服务主体认证
• 已安装对应版本的azurerm、azuread Terraform Provider

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.0"
    }
  }
}

provider "azurerm" {
  features {}
}

provider "azuread" {}

注意：如果你的Key Vault已开启azure_rbac_authorization参数（即使用Azure RBAC作为权限管理模式），无需配置传统访问策略，直接为服务主体分配Key Vault Secrets User等对应RBAC角色即可 #

场景1：为已存在的服务主体授予Key Vault访问策略 #

你可以通过data源自动拉取已有资源信息，避免硬编码参数：

# 获取已存在的服务主体信息，替换为目标SP的客户端ID
data "azurerm_service_principal" "existing_sp" {
  client_id = "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

# 获取已存在的Key Vault信息，替换为你的Key Vault名称和资源组
data "azurerm_key_vault" "target_kv" {
  name                = "your-key-vault-name"
  resource_group_name = "your-resource-group-name"
}

# 配置访问策略
resource "azurerm_key_vault_access_policy" "sp_kv_policy" {
  key_vault_id = data.azurerm_key_vault.target_kv.id
  tenant_id    = data.azurerm_key_vault.target_kv.tenant_id
  object_id    = data.azurerm_service_principal.existing_sp.object_id

  # 密钥权限，可根据业务需求自行增减
  key_permissions = [
    "Get", "List"
  ]

  # 机密权限，可根据业务需求自行增减
  secret_permissions = [
    "Get", "List", "Set", "Delete"
  ]

  # 证书权限，可根据业务需求自行增减
  certificate_permissions = [
    "Get", "List"
  ]
}

提示：如果不想通过data源查询，也可以直接将object_id替换为已有的服务主体对象ID；配置访问策略时object_id需传入服务主体的对象ID，而非客户端ID #

场景2：创建服务主体并自动授予Key Vault访问权限 #

完整脚本如下，创建完成后会自动输出服务主体的核心信息：

# 1. 创建Azure AD应用注册
resource "azuread_application" "new_sp_app" {
  display_name = "your-sp-display-name"
}

# 2. 基于应用注册创建服务主体
resource "azuread_service_principal" "new_sp" {
  client_id = azuread_application.new_sp_app.client_id
}

# 3. 获取目标Key Vault信息，替换为实际参数
data "azurerm_key_vault" "target_kv" {
  name                = "your-key-vault-name"
  resource_group_name = "your-resource-group-name"
}

# 4. 为新建服务主体配置Key Vault访问策略
resource "azurerm_key_vault_access_policy" "new_sp_kv_policy" {
  key_vault_id = data.azurerm_key_vault.target_kv.id
  tenant_id    = data.azurerm_key_vault.target_kv.tenant_id
  object_id    = azuread_service_principal.new_sp.object_id

  key_permissions = [
    "Get", "List"
  ]

  secret_permissions = [
    "Get", "List", "Set"
  ]

  certificate_permissions = [
    "Get", "List"
  ]
}

# 输出新建服务主体的核心信息，敏感参数默认隐藏
output "new_sp_client_id" {
  value = azuread_service_principal.new_sp.client_id
  sensitive = true
}

output "new_sp_object_id" {
  value = azuread_service_principal.new_sp.object_id
  sensitive = true
}

执行完成后可通过terraform output new_sp_client_id命令获取新建服务主体的客户端ID用于后续使用。

内容的提问来源于stack exchange，提问作者RICHARD