如何用Azure ARM模板跨资源组部署VM并配置现有Key Vault访问策略？

我完全懂你这种找不到现成方案的苦恼——同一资源组里一套流程走得通，跨组就卡壳了对吧？其实只要利用ARM模板的跨资源引用能力，再配合对MSI身份的正确传递，就能搞定这个需求。下面给你详细拆解实现步骤和完整模板：

核心实现思路 #

• 在资源组A中部署带系统分配MSI的虚拟机
• 通过resourceId()函数引用资源组B中的现有密钥库
• 将VM的MSI主体ID注入密钥库的访问策略配置中，完成跨组权限赋予

关键步骤与模板示例 #

1. 模板参数配置 #

先定义必要的参数，包括两个资源组名称、VM配置、密钥库信息和要赋予的权限：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vmResourceGroupName": {
      "type": "string",
      "defaultValue": "资源组A"
    },
    "keyVaultResourceGroupName": {
      "type": "string",
      "defaultValue": "资源组B"
    },
    "vmName": {
      "type": "string",
      "defaultValue": "myVM"
    },
    "keyVaultName": {
      "type": "string",
      "defaultValue": "myExistingKV"
    },
    "msiKeyVaultPermissions": {
      "type": "array",
      "defaultValue": ["get", "list"]
    },
    "vmSize": {
      "type": "string",
      "defaultValue": "Standard_D2s_v3"
    },
    "adminUsername": {
      "type": "string"
    },
    "adminPassword": {
      "type": "secureString"
    }
  },
  "variables": {
    "vmResourceId": "[resourceId(parameters('vmResourceGroupName'), 'Microsoft.Compute/virtualMachines', parameters('vmName'))]",
    "keyVaultResourceId": "[resourceId(parameters('keyVaultResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
  },

2. 部署带系统分配MSI的VM（资源组A） #

在resources数组中添加VM资源，并启用系统分配的托管身份：

"resources": [
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2023-07-01",
      "name": "[parameters('vmName')]",
      "location": "[resourceGroup().location]",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "hardwareProfile": {
          "vmSize": "[parameters('vmSize')]"
        },
        "osProfile": {
          "computerName": "[parameters('vmName')]",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "MicrosoftWindowsServer",
            "offer": "WindowsServer",
            "sku": "2022-Datacenter",
            "version": "latest"
          },
          "osDisk": {
            "caching": "ReadWrite",
            "createOption": "FromImage"
          }
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', concat(parameters('vmName'), '-nic'))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces', concat(parameters('vmName'), '-nic'))]"
      ]
    },

3. 为资源组B的密钥库添加MSI访问策略 #

添加Microsoft.KeyVault/vaults/accessPolicies资源，注意要引用跨组的密钥库，并获取VM的MSI主体ID：

{
      "type": "Microsoft.KeyVault/vaults/accessPolicies",
      "apiVersion": "2023-07-01",
      "name": "[concat(parameters('keyVaultName'), '/add')]",
      "properties": {
        "accessPolicies": [
          {
            "tenantId": "[subscription().tenantId]",
            "objectId": "[reference(variables('vmResourceId'), '2023-07-01').identity.principalId]",
            "permissions": {
              "secrets": "[parameters('msiKeyVaultPermissions')]",
              "keys": [],
              "certificates": []
            }
          }
        ]
      },
      "dependsOn": [
        "[variables('vmResourceId')]"
      ]
    }
  ]
}

重要注意事项 #

• 权限要求：执行部署的账号需要具备：
  • 资源组A的Microsoft.Compute/virtualMachines/write权限
  • 资源组B的Microsoft.KeyVault/vaults/accessPolicies/write权限
• API版本兼容性：确保VM和密钥库使用的API版本是最新且兼容的（示例中用的是2023-07-01）
• 部署模式：使用Incremental模式部署模板，避免覆盖密钥库的现有访问策略
• 用户分配MSI：如果用的是用户分配MSI，只需把objectId替换为用户分配MSI的ID即可，无需依赖VM的部署

内容的提问来源于stack exchange，提问作者Maashu