对象参数内的 ARM 模板密钥库访问策略

Question

当我为 azure keyvault 部署我的 ARM 模板时，我收到此错误消息。

 "error": {
    "code": "BadRequest",
    "message": "An invalid value was provided for 'accessPolicies'."
  }

我的模板：

  {
            "type": "Microsoft.KeyVault/vaults",
            "name": "[parameters('keyVaultName')]",
            "apiVersion": "2016-10-01",
            "location": "[parameters('location')]",
            "properties": {
                "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
                "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
                "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]",
                "tenantId": "[parameters('tenantId')]",
                "accessPolicies": [],
                "sku": {
                    "name": "[parameters('skuName')]",
                    "family": "A"
                }
            }
        },
        {
            "type": "Microsoft.KeyVault/vaults/accessPolicies",
            "name": "[concat(parameters('keyVaultName'), '/add')]",
            "apiVersion": "2018-02-14",
            "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
            ],
            "properties": {
                "copy": [
                    {
                        "name": "accessPolicies",
                        "count": "[length(parameters('ObjectPolicies'))]",
                        "input": {
                            "tenantId": "[parameters('ObjectPolicies')[copyIndex('accessPolicies')].tenantId]",
                            "objectId": "[parameters('ObjectPolicies')[copyIndex('accessPolicies')].objectId]",
                            "permissions": {
                                "keys": "[parameters('ObjectPolicies')[copyIndex('accessPolicies')].permissions.keys]",
                                "secrets": "[parameters('ObjectPolicies')[copyIndex('accessPolicies')].permissions.secrets]"
                            }
                        }
                    }
                ]
            }
        }

我的参数文件：

  "ObjectPolicies": {
            "value": [
                {
                    "tenantId": "xxxxx",
                    "objectId": "xxxxx",
                    "permissions": {
                        "keys": [
                            "all"
                        ],
                        "secrets": [
                            "all"
                        ]
                    }
                },

我想在一个对象中创建一个具有多个访问策略的 Keyvault，以便在我的参数中获得一个很好的概览。而不是 objectID1 , objectId2, objectId 3. 试图从这个 Good answer over here复制答案。似乎我的设置与 4c74356b41 相同，但仍然有错误消息。

这个SO 问题也有相同的错误消息，但他似乎没有为他的问题添加答案。

Answer 1

我认为不支持“all”作为权限值，至少根据 api 参考，您必须一一列出所有这些。

"accessPolicies": [
    {
        "tenantId": "00000000-0000-0000-0000-000000000000",
        "objectId": "00000000-0000-0000-0000-000000000000",
        "permissions": {
            "keys": [
                "encrypt",
                "decrypt",
                "wrapKey",
                "unwrapKey",
                "sign",
                "verify",
                "get",
                "list",
                "create",
                "update",
                "import",
                "delete",
                "backup",
                "restore",
                "recover",
                "purge"
            ],
            "secrets": [
                "get",
                "list",
                "set",
                "delete",
                "backup",
                "restore",
                "recover",
                "purge"
            ],
            "certificates": [
                "get",
                "list",
                "delete",
                "create",
                "import",
                "update",
                "managecontacts",
                "getissuers",
                "listissuers",
                "setissuers",
                "deleteissuers",
                "manageissuers",
                "recover",
                "purge"
            ]
        }
    }
]

阅读：
https://learn.microsoft.com/en-us/rest/api/keyvault/vaults/createorupdate#create_a_new_vault_or_update_an_existing_vault