无法在链接的ARM模板之间传递安全值的问题求助

我来帮你梳理下如何在Azure ARM链接模板中创建机密并跨模板引用的实现方案，结合你给出的主模板结构，完整的示例如下：

1. 主部署模板（根模板） #

这个模板负责调用两个链接模板，确保部署顺序，并传递必要的参数：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "templateBaseUrl": {
      "type": "string"
    },
    "keyVaultName": {
      "type": "string",
      "defaultValue": "[concat('kv-', uniqueString(resourceGroup().id))]"
    },
    "secretName": {
      "type": "string",
      "defaultValue": "mySecret"
    },
    "secretValue": {
      "type": "securestring"
    }
  },
  "variables": {
    "deployment1url": "[concat(parameters('templateBaseUrl'), '/deployment1.json')]",
    "deployment2url": "[concat(parameters('templateBaseUrl'), '/deployment2.json')]"
  },
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "deployKeyVaultAndSecret",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('deployment1url')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "secretName": {
            "value": "[parameters('secretName')]"
          },
          "secretValue": {
            "value": "[parameters('secretValue')]"
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "deployResourceUsingSecret",
      "dependsOn": [
        "[resourceId('Microsoft.Resources/deployments', 'deployKeyVaultAndSecret')]"
      ],
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('deployment2url')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "secretName": {
            "value": "[parameters('secretName')]"
          }
        }
      }
    }
  ]
}

2. Deployment1模板（创建Key Vault和机密） #

这个模板负责创建Azure Key Vault并存储机密，同时配置必要的权限让后续模板可以访问：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVaultName": {
      "type": "string"
    },
    "secretName": {
      "type": "string"
    },
    "secretValue": {
      "type": "securestring"
    },
    "tenantId": {
      "type": "string",
      "defaultValue": "[subscription().tenantId]"
    }
  },
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "2023-02-01",
      "name": "[parameters('keyVaultName')]",
      "location": "[resourceGroup().location]",
      "properties": {
        "sku": {
          "family": "A",
          "name": "standard"
        },
        "tenantId": "[parameters('tenantId')]",
        "accessPolicies": [
          {
            "tenantId": "[parameters('tenantId')]",
            "objectId": "[reference(deployment().principalId).objectId]",
            "permissions": {
              "secrets": [
                "get",
                "list",
                "set"
              ]
            }
          }
        ],
        "enabledForTemplateDeployment": true
      }
    },
    {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2023-02-01",
      "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
      ],
      "properties": {
        "value": "[parameters('secretValue')]"
      }
    }
  ]
}

3. Deployment2模板（引用机密作为参数） #

这个模板通过Key Vault引用获取之前创建的机密，并用它来配置资源：

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVaultName": {
      "type": "string"
    },
    "secretName": {
      "type": "string"
    },
    "mySecureParameter": {
      "type": "securestring",
      "defaultValue": "[reference(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretName'))).value]"
    }
  },
  "resources": [
    // 示例：使用机密配置SQL Server管理员密码
    {
      "type": "Microsoft.Sql/servers",
      "apiVersion": "2022-05-01-preview",
      "name": "[concat('sql-', uniqueString(resourceGroup().id))]",
      "location": "[resourceGroup().location]",
      "properties": {
        "administratorLogin": "sqladmin",
        "administratorLoginPassword": "[parameters('mySecureParameter')]"
      }
    }
  ]
}

关键注意事项 #

• 部署顺序：主模板中第二个部署通过dependsOn依赖第一个部署，确保Key Vault和机密先创建完成，避免后续模板引用时出现资源不存在的错误。
• Key Vault配置：必须将enabledForTemplateDeployment设为true，否则ARM模板无法直接引用Key Vault中的机密。
• 访问权限：要确保执行部署的主体（用户或服务主体）拥有Key Vault的机密权限（至少get和list），示例中已经自动给部署主体添加了权限。
• 机密安全性：机密以securestring类型传递，不会在部署日志或模板输出中暴露，符合Azure安全最佳实践。

内容的提问来源于stack exchange，提问作者Noble