部署 Key Vault 访问策略时如何在 Bicep 中引用系统分配的身份

Question

对于一个项目，我想通过 Bicep 模板将三个相关资源部署到 Azure：1) 具有系统分配托管标识的应用服务，2) Key Vault 和 3) 应用服务（步骤 1）到 Key Vault（步骤 2）的访问策略）。

AppService 部署输出principalId系统分配的标识，稍后在部署 KeyVaultAccessPolicy 时使用该标识。

但是，当我运行 AZ CLI ( az deployment sub create --location WestEurope --template-file ./main.bicep --parameters ./parameters/parameters-dev.json) 将其部署到 Azure 时，出现以下错误：

'The language expression property 'outputs' doesn't exist, available properties are 'templateHash, parameters, mode, provisioningState, timestamp, duration, correlationId, providers, dependencies, outputResources'.

有谁知道为什么引用principalId应用程序服务在这里不起作用？非常感谢您的帮助。

模块和 main.bicep：

主二头肌

module appService 'modules/appService.bicep' = {
  name:  'deployAppService'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: appServiceName
    location: appServiceLocation
    alwaysOn: appServiceAlwaysOn
    apimIpAddress: appServiceApimIpAddress
    appServicePlanResourceGroup: appServicePlanResourceGroup
    appServicePlanName: appServicePlanName
  }
}

module keyVault 'modules/keyVault.bicep' = {
  name: 'deployKeyVault'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: keyVaultName
    dependsOn: [ appService ]
    location: appServiceLocation
  }
}

module keyVaultAccessPolicy 'modules/keyVaultAccessPolicy.bicep' = {
  name: 'deployKeyVaultAccessPolicy'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: '${appServiceName}-ap'
    dependsOn: [ keyVault ]
    objectId: appService.outputs.appServiceManagedIdentity
  }
}

应用程序服务.bicep

resource appService 'Microsoft.Web/sites@2020-12-01' = {
  name: name
  location: location
  kind: 'app'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: '${subscription().id}/resourceGroups/${appServicePlanResourceGroup}/providers/Microsoft.Web/serverfarms/${appServicePlanName}'
    enabled: true
  }
}

output appServiceManagedIdentity string = appService.identity.principalId

keyVault.bicep

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: name
  location: location
  dependsOn: dependsOn
  properties: {
    enabledForDeployment: true
    enabledForTemplateDeployment: true
    enabledForDiskEncryption: true
    tenantId: subscription().tenantId
    accessPolicies: []
    sku: {
      name: 'standard'
      family: 'A'
    }
  }
}

keyVaultAccessPolicy.bicep

resource keyVaultAccessPolicy 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
  name: name
  dependsOn: dependsOn
  properties: {
    accessPolicies: [
      {
        tenantId: subscription().tenantId
        objectId: objectId
        permissions: {
          secrets: [
            'get'
          ]
        }
      }
    ]
  }
}

Answer 1

已经找到答案了：

1. 我错过了模块已经包含一个dependsOn属性，因此不需要将依赖项传递为param.
2. KeyVaultAccessPolicy 的名称不包含对父资源 (KeyVault) 的引用，请参见name: '${keyVaultName}/add'下文

请参阅下面的工作模块和 main.bicep：

主二头肌

module appService 'modules/appService.bicep' = {
  name:  'deployAppService'
  scope: resourceGroup(appServiceResourceGroup)
  params: {
    name: appServiceName
    location: appServiceLocation
    alwaysOn: appServiceAlwaysOn
    apimIpAddress: appServiceApimIpAddress
    appServicePlanResourceGroup: appServicePlanResourceGroup
    appServicePlanName: appServicePlanName
  }
}

module keyVault 'modules/keyVault.bicep' = {
  scope: resourceGroup(appServiceResourceGroup)
  name: 'keyVaultDeploy'
  params: {
    location: appServiceLocation
    name: keyVaultName
  }
}

module keyVaultAccessPolicy 'modules/keyVaultAccessPolicy.bicep' = {
  scope: resourceGroup(appServiceResourceGroup)
  name: 'keyVaultAccessPolicyDeploy'
  dependsOn: [
    keyVault
  ]
  params: {
    keyVaultName: keyVaultName
    objectId: appService.outputs.appServiceManagedIdentity
  }
}

应用程序服务.bicep

resource appService 'Microsoft.Web/sites@2020-12-01' = {
  name: name
  location: location
  kind: 'app'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    // left out 
  }
}

output appServiceManagedIdentity string = appService.identity.principalId

keyVault.bicep

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: name
  location: location
  properties: {
    enabledForDeployment: true
    enabledForTemplateDeployment: true
    enabledForDiskEncryption: true
    tenantId: subscription().tenantId
    accessPolicies: []
    sku: {
      name: 'standard'
      family: 'A'
    }
  }
}

keyVaultAccessPolicy.bicep

resource keyVaultAccessPolicy 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
  name: '${keyVaultName}/add'
  properties: {
    accessPolicies: [
      {
        tenantId: subscription().tenantId
        objectId: objectId
        permissions: {
          secrets: [
            'get'
          ]
        }
      }
    ]
  }
}