需要帮助以了解在不同环境中维护 azure key vault 以及能够在逻辑应用程序中使用它

Question

我有一个逻辑应用程序，它对 Key Vault URI 进行 HTTP 调用以获取连接到外部系统所需的机密。我在开发资源组中开发了这个。我想知道如何设置从开发资源组到其他资源组 (test/prod) 的密钥保管库。此外，如何迁移逻辑应用并获取每个环境的机密。

Answer 1

:) 解决方法是使用ARM templates和ADO/any other pipeline。您可以为不同的环境创建具有不同参数值的 ARM 模板，并使用它们将您的逻辑应用程序和密钥保管库部署到不同的环境。

Logic App Template sample:

{
   "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
   "contentVersion": "1.0.0.0",
   // Template parameters
   "parameters": {
      "<template-parameter-name>": {
         "type": "<parameter-type>",
         "defaultValue": "<parameter-default-value>",
         "metadata": {
            "description": "<parameter-description>"
         }
      }
   },
   "variables": {},
   "functions": [],
   "resources": [
      {
         // Start logic app resource definition
         "properties": {
            <other-logic-app-resource-properties>,
            "definition": {
               "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
               "actions": {<action-definitions>},
               // Workflow definition parameters
               "parameters": {
                  "<workflow-definition-parameter-name>": {
                     "type": "<parameter-type>",
                     "defaultValue": "<parameter-default-value>",
                     "metadata": {
                        "description": "<parameter-description>"
                     }
                  }
               },
               "triggers": {
                  "<trigger-name>": {
                     "type": "<trigger-type>",
                     "inputs": {
                         // Workflow definition parameter reference
                         "<attribute-name>": "@parameters('<workflow-definition-parameter-name')"
                     }
                  }
               },
               <...>
            },
            // Workflow definition parameter value
            "parameters": {
               "<workflow-definition-parameter-name>": { 
                  "value": "[parameters('<template-parameter-name>')]"
               }
            },
            "accessControl": {}
         },
         <other-logic-app-resource-definition-attributes>
      }
      // End logic app resource definition
   ],
   "outputs": {}
}

Key Vault template:

{
  "name": "string",
  "type": "Microsoft.KeyVault/vaults",
  "apiVersion": "2018-02-14",
  "location": "string",
  "tags": {},
  "properties": {
    "tenantId": "string",
    "sku": {
      "family": "A",
      "name": "string"
    },
    "accessPolicies": [
      {
        "tenantId": "string",
        "objectId": "string",
        "applicationId": "string",
        "permissions": {
          "keys": [
            "string"
          ],
          "secrets": [
            "string"
          ],
          "certificates": [
            "string"
          ],
          "storage": [
            "string"
          ]
        }
      }
    ],
    "vaultUri": "string",
    "enabledForDeployment": "boolean",
    "enabledForDiskEncryption": "boolean",
    "enabledForTemplateDeployment": "boolean",
    "enableSoftDelete": "boolean",
    "createMode": "string",
    "enablePurgeProtection": "boolean",
    "networkAcls": {
      "bypass": "string",
      "defaultAction": "string",
      "ipRules": [
        {
          "value": "string"
        }
      ],
      "virtualNetworkRules": [
        {
          "id": "string"
        }
      ]
    }
  },
  "resources": []
}

此外，您可以阅读这篇文章以了解有关设置 ADO 管道的更多信息：Integrate ARM templates with Azure Pipelines

需要帮助以了解在不同环境中维护 azure key vault 以及能够在逻辑应用程序中使用它

Need help to understand maintaining azure key vault in different environment and also to be able to use that in logic app

azure-logic-apps

azure-keyvault