使用经典Pulumi.Azure配置App Service访问Key Vault的实现方法

核心实现逻辑 #

• 首先为App Service开启系统分配托管标识，Pulumi会自动创建与App Service绑定的Azure AD服务主体，服务主体的对象ID会作为输出属性直接暴露在App Service资源对象上
• 然后在Key Vault的访问策略中，直接引用App Service托管标识的对象ID、租户ID配置权限，全程不需要手动硬编码任何资源ID

修正后完整代码实现 #

1. 配置App Service的系统托管标识 #

在原App Service资源定义中，新增Identity配置块开启系统分配标识，完全等价于Azure门户中点击「On」开启托管标识的操作：

var appservice = new AppService(appserviceName, new AppServiceArgs
{
    Name = appserviceName,
    Location = _resourceGroup.Location,
    AppServicePlanId = _servicePlan.Id,
    ResourceGroupName = _resourceGroup.Name,
    // 开启系统分配托管标识
    Identity = new Pulumi.Azure.AppService.Inputs.AppServiceIdentityArgs
    {
        Type = "SystemAssigned"
    },
    SiteConfig = new Pulumi.Azure.AppService.Inputs.AppServiceSiteConfigArgs
    {
        DotnetFrameworkVersion = "v5.0",
        ScmType = "None",
    },
    Tags = { { "environment", "dev" } },
    Logs = new AppServiceLogsArgs
    {
        HttpLogs = new AppServiceLogsHttpLogsArgs
        {
            FileSystem = new AppServiceLogsHttpLogsFileSystemArgs { RetentionInDays = 14, RetentionInMb = 35 }
        }
    },
    AppSettings = appSettings
});

2. 为Key Vault新增App Service托管标识的访问策略 #

在原Key Vault的AccessPolicies集合中，追加基于App Service托管标识输出属性的策略条目：

var currentConfig = Output.Create(GetClientConfig.InvokeAsync());
var keyVault = new KeyVault(vaultname, new KeyVaultArgs
{
    Name = vaultname,
    Location = _resourceGroup.Location,
    ResourceGroupName = _resourceGroup.Name,
    TenantId = currentConfig.Apply(q => q.TenantId),
    SkuName = "standard",
    AccessPolicies =
    {
        // 保留原有用户自身的访问策略
        new Pulumi.Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
        {
            TenantId = currentConfig.Apply(q => q.TenantId),
            ObjectId = currentConfig.Apply(q => q.ObjectId),
            KeyPermissions = {"get", "create", "list"},
            SecretPermissions = {"set","get","delete","purge","recover", "list"}
        },
        // 新增App Service托管标识的访问策略
        new Pulumi.Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
        {
            // 读取托管标识所属租户ID
            TenantId = appservice.Identity.Apply(id => id.TenantId),
            // 读取托管标识的主体ID，即Key Vault授权需要的ObjectId
            ObjectId = appservice.Identity.Apply(id => id.PrincipalId),
            // 按最小权限原则配置密钥读取权限，可根据业务调整
            SecretPermissions = {"get", "list"}
        }
    }
});

注意事项 #

• Pulumi会自动识别资源间的依赖关系，确保先完成App Service托管标识的创建、拿到有效的主体ID后，再应用Key Vault的访问策略，不存在空值引用问题
• 原代码中Tags的键值environemnt为拼写错误，修正为environment避免后续标签检索异常
• 权限配置可按需调整，若App Service需要读取Key Vault中的证书、密钥，可在策略中追加对应权限条目

内容的提问来源于stack exchange，提问作者Ole Albers