使用ARM Template创建Azure Function时连接字符串与密钥管理最佳实践

Great questions! Let's break down the best practices for both scenarios you've asked about, along with comparisons of the approaches you mentioned:

• Layer your configuration: Separate settings into environment-agnostic (e.g., feature flags, core API paths) and environment-specific (e.g., database endpoints, third-party API keys). Environment-specific values should never be hardcoded in templates.
• Parameterize templates: Use ARM template parameters to define configurable values. This makes your templates reusable across environments (dev/test/prod) without modifying the core template structure.
• Dynamic references for in-deployment resources: For resources being deployed in the same operation, use reference() or list functions (like listKeys()) to pull values dynamically instead of manually inputting them. This reduces human error and keeps settings in sync with actual resource states.
• Version control everything: Store your ARM templates and non-sensitive parameter files in a Git repository. This lets you track changes, roll back if needed, and collaborate with your team safely.

Let's cover the options you mentioned, plus the optimal approach:

Using listKeys and listConnectionStrings Functions #

• Same resource group: This is the simplest case—use listKeys(resourceId('Microsoft.Storage/storageAccounts', '<storageName>'), '2023-01-01').keys[0].value to get an access key, or use listConnectionStrings() if the resource supports it (like storage accounts):

  "connectionString": "[listConnectionStrings(resourceId('Microsoft.Storage/storageAccounts', '<storageName>'), '2023-01-01').connectionStrings[0].value]"
  

  This is better than concat() because it returns the official, properly formatted connection string directly—no risk of messing up the format if the resource's connection string structure changes.
• Cross resource group: You just need to specify the full resource ID with the target resource group:

  "accessKey": "[listKeys(resourceId('<targetResourceGroup>', 'Microsoft.Storage/storageAccounts', '<storageName>'), '2023-01-01').keys[0].value]"
  

  Note: Your deployment identity needs the Microsoft.Storage/storageAccounts/listKeys/action permission on the target resource.
• Cross subscription: Extend the resource ID to include the subscription ID:

  "accessKey": "[listKeys(resourceId('/subscriptions/<subscriptionId>/resourceGroups/<targetResourceGroup>/providers/Microsoft.Storage/storageAccounts/<storageName>'), '2023-01-01').keys[0].value]"
  

  Again, ensure your deployment identity has the necessary permissions across subscriptions.

Key Vault: The Optimal Long-Term Solution #

For sensitive values like access keys and connection strings, Azure Key Vault is the gold standard—here's why:

• Security & compliance: Secrets are encrypted at rest and in transit, and you can enforce fine-grained access control (only allow specific identities to read secrets). No sensitive data appears in templates, parameter files, or deployment logs.
• Seamless cross-resource/subscription access: As long as your deployment identity has the Key Vault Secrets User role (or equivalent) on the vault, you can pull secrets regardless of where the underlying resource lives. Example in ARM:

  "connectionString": "[reference(resourceId('<kvResourceGroup>', 'Microsoft.KeyVault/vaults', '<kvName>'), '2023-07-01').secrets['<secretName>'].value]"
  

• Automatic key rotation: Many resources (like storage accounts) can auto-rotate keys and sync the new value to Key Vault—you don't need to update your templates or app settings when keys change.
• Centralized management: All your sensitive config lives in one place, making it easy to audit, rotate, and revoke access.

External Parameter Files: Use With Caution #

Storing secrets in external parameter files is not recommended for production:

• If you commit the parameter file to Git, you're exposing sensitive data.
• Managing multiple parameter files per environment is error-prone and doesn't support automatic key rotation.
• If you must use parameter files for non-sensitive values, keep them in version control—but never include secrets here.

• For app settings: Layer configuration, parameterize templates, use dynamic references for in-deployment resources, and version control everything.
• For connection strings/access keys:
  1. Prefer Key Vault for all sensitive values, especially cross-resource/subscription scenarios.
  2. Use listConnectionStrings() instead of concat() when available—it's more reliable.
  3. Use listKeys() with full resource IDs for cross-resource/subscription access only if Key Vault isn't an option, and ensure proper permissions are in place.

内容的提问来源于stack exchange，提问作者Evan Park