如何使用托管标识为逻辑应用程序创建与 Azure KeyVault 的 Api 连接

Scenario

你好，我想创建Logic App从中得到秘密Azure KeyVault并将经过身份验证的请求发送到 API，并使用保管库中的秘密。

Problem

我收到：The workflow connection parameter 'keyvault' is not valid. The API connection 'keyvault' is not configured to support managed identity.在我的 ARM 部署期间。如何创建Microsoft.Web/Connections具有来自 ARM 模板的托管身份。文档中没有有关它的信息：api连接 https://learn.microsoft.com/en-us/azure/templates/microsoft.web/connections 逻辑应用-MSI https://learn.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity#authenticate-access-with-managed-identity

repro

{
  "type": "Microsoft.Web/connections",
  "apiVersion": "2016-06-01",
  "name": "[variables('KeyVault_Connection_Name')]",
  "location": "[variables('location')]",
  "kind": "V1",
  "properties": {
    "api": {
      "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
    },
    "parameterValues": {
      "vaultName": "[variables('keyVaultName')]"
    },
    "displayName": "[variables('KeyVault_Display_Connection_Name')]"
  }
},
{
  "type": "Microsoft.Logic/workflows",
  "apiVersion": "2017-07-01",
  "name": "[variables('logicAppName')]",
  "location": "[variables('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "dependsOn": [
    "[resourceId('Microsoft.Web/Connections', variables('KeyVault_Connection_Name'))]"
  ],
  "properties": {
    "state": "Enabled",
    "definition": {
      "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
      "contentVersion": "1.0.0.0",
      "parameters": {
        "$connections": {
          "defaultValue": {},
          "type": "Object"
        }
      },
      "triggers": {schedule trigger},
      "actions": {get secret, send HTTP},
      "outputs": {}
    },
    "parameters": {
      "$connections": {
        "value": {
          "keyvault": {
            "connectionId": "[concat('/subscriptions/', variables('subscriptionId'), '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.Web/connections/', variables('KeyVault_Connection_Name'))]",
            "connectionName": "[variables('KeyVault_Display_Connection_Name')]",
            "connectionProperties": {
              "authentication": {
                "type": "ManagedServiceIdentity"
              }
            },
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'),'/managedApis/keyvault')]"
          }
        }
      }
    }
  }
}

Tried

I added parameterValueType具有价值 替代Microsoft.Web/connections。还需要删除parameterValue，因为它会导致错误。

{
    "type": "Microsoft.Web/connections",
    "apiVersion": "2016-06-01",
    "name": "[variables('KeyVault_Connection_Name')]",
    "location": "[variables('location')]",
    "kind": "V1",
    "properties": {
        "api": {
            "id": "[concat('/subscriptions/', variables('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/', 'keyvault')]"
        },
        "parameterValueType": "Alternative",
        "displayName": "[variables('KeyVault_Display_Connection_Name')]"
    }
},

现在，当 GET 秘密时，我在运行时收到错误：

{
  "status": 400,
  "message": "The connection does not contain a vault name. Please edit the connection and enter a valid key vault name.",
  "error": {
    "message": "The connection does not contain a vault name. Please edit the connection and enter a valid key vault name."
  },
  "source": "keyvault-we.azconn-we.p.azurewebsites.net"
}

我也尝试过添加vaultName to customParameterValues但这没有帮助。

不完全是问题的答案，但我在寻找类似问题时最终来到这里。

For 用户分配的托管身份，使用的属性不同。

你需要设置parameterValueSet如下：

{
  "type": "Microsoft.Web/connections",
  "apiVersion": "2016-06-01",
  "name": "[variables('connection-keyvault-name')]",
  "location": "[variables('location')]",
  "kind": "V1",
  "properties": {
    "displayName": "[concat(variables('logic-app-get-token-name'), '-to-keyvault')]",
    "api": {
      "name": "keyvault",
      "id": "[concat(subscription().id, '/providers/Microsoft.Web/locations/', variables('location'), '/managedApis/keyvault')]",
      "type": "Microsoft.Web/locations/managedApis"
    },
    "parameterValueSet": {
        "name": "oauthMI",
        "values": {
            "vaultName": {
                "value": "[parameters('keyvault_configuration_name')]"
            }
        }
      }
    }
}