The secret of KeyVault parameter '' cannot be retrieved. Http status code: 'Forbidden'. Error message: 'Access denied to first party service

huangapple
go评论108阅读模式
英文:

The secret of KeyVault parameter '' cannot be retrieved. Http status code: 'Forbidden'. Error message: 'Access denied to first party service

问题

I understand your request. Here's the translation of the code and text you provided:

  1. 我们有一个 Azure DevOps 管道，用于使用 Bicep 文件部署 Azure 基础设施。在 Azure 中，我们已经创建了一个应用注册服务主体，并将其添加为我们订阅的贡献者，然后我们在 Azure DevOps 中将其用作服务连接，以便我们可以部署所需的基础设施。
  3. 在管道中，我们正在创建一个 Key Vault 并将服务主体添加到访问策略中。此外，在 Bicep 中，我尝试获取一个密码作为另一个基础设施资源的密码，但是我一直收到以下错误消息：
  5. {
  6.   "status": "Failed",
  7.   "error": {
  8.     "code": "DeploymentFailed",
  9.     "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
  10.     "details": [
  11.       {
  12.         "code": "Forbidden",
  13.         "message": "{
  14.   \"error\": {
  15.     \"code\": \"KeyVaultParameterReferenceSecretRetrieveFailed\",
  16.     \"message\": \"The secret of KeyVault parameter 'password' cannot be retrieved. Http status code: 'Forbidden'. Error message: 'Access denied to first party service.\\r\\nCaller: name=ARM;tid=f8cdef31...;appid=797f4846...;oid=f248a218...;iss=https://sts.windows.net/f8cdef31.../\\r\\nVault: kv-kf-web-shared-fea-ne;location=northeurope'. Please see https://aka.ms/arm-keyvault for usage details.\"
  17.   }"
  18.       }
  19.     ]
  20.   }
  21. }
  23. main.bicep:
  24. {
  25.   // 模块: Key Vault
  26.   module keyVaultModule '../../Bicep.Modules/keyVault.bicep' = {
  27.     name: 'keyVaultDeployment'
  28.     params: {
  29.       application: '${application}-shared'
  30.       environment: environment
  31.       location: location
  32.       tags: tags
  33.     }
  34.     scope: resourceGroup
  35.   }
  37.   resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  38.     name: keyVaultModule.outputs.name
  39.     scope: resourceGroup
  40.   }
  42.   // 模块: SQL Server
  43.   module databaseServerModule '../../Bicep.Modules/databaseServer.bicep' = {
  44.     name: 'databaseServerDeployment'
  45.     params: {
  46.       application: '${application}-shared'
  47.       environment: environment
  48.       location: location
  49.       tags: tags
  50.       keyVaultName: keyVaultModule.outputs.name
  51.       password: keyVault.getSecret('password-databaseServer-sql-${application}-shared-${environment}-${shortlocation}')
  52.     }
  53.     scope: resourceGroup
  54.   }
  55. }
  57. /keyVault.bicep:
  58. {
  59.   // 资源 - Function App
  60.   resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  61.     name: name
  62.     location: location
  63.     tags: tags
  64.     properties: {
  65.       accessPolicies: [
  66.         {
  67.           objectId: '{ AAD-GRP-Dev-DevOps Object Id }'
  68.           permissions: {
  69.             certificates: [
  70.               'all'
  71.             ]
  72.             keys: [
  73.               'all'
  74.             ]
  75.             secrets: [
  76.               'all'
  77.             ]
  78.             storage: [
  79.               'all'
  80.             ]
  81.           }
  82.           tenantId: subscription().tenantId
  83.         }
  84.         {
  85.           objectId: '{ Windows Azure Service Management API Object Id }'
  86.           permissions: {
  87.             certificates: [
  88.               'all'
  89.             ]
  90.             keys: [
  91.               'all'
  92.             ]
  93.             secrets: [
  94.               'all'
  95.             ]
  96.             storage: [
  97.               'all'
  98.             ]
  99.           }
  100.           tenantId: subscription().tenantId
  101.         }
  102.         {
  103.           objectId: '{ Windows Azure Service Management API Object Id }'
  104.           permissions: {
  105.             certificates: [
  106.               'all'
  107.             ]
  108.             keys: [
  109.               'all'
  110.             ]
  111.             secrets: [
  112.               'all'
  113.             ]
  114.             storage: [
  115.               'all'
  116.             ]
  117.           }
  118.           tenantId: subscription().tenantId
  119.         }
  120.       ]
  121.       sku: {
  122.         family: 'A'
  123.         name: 'standard'
  124.       }
  125.       tenantId: subscription().tenantId
  126.     }
  127.   }
  128. }
  130. Key Vault 访问策略:
  132. [![图片描述][1]][1]
  134. [1]: https://i.stack.imgur.com/3jTWk.png
英文:

We have a Azure DevOps pipeline that we are using to deploy infrastructure to Azure using bicep files. In Azure, We have create a App Registration Service Principle and added it as a contributor to our Subscription, which we use as a Service Connection within Azure DevOps to allow us to deploy the required infrastructure.

In the pipeline we are creating a Key Vault and adding the Service Principle to the Access Policies. Further in the Bicep I am trying to get a secret to use as the password for another infrastructure resource, but I keep getting the following error:

  1. {
  2.   "status": "Failed",
  3.   "error": {
  4.     "code": "DeploymentFailed",
  5.     "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
  6.     "details": [
  7.       {
  8.         "code": "Forbidden",
  9.         "message": "{\r\n  \"error\": {\r\n    \"code\": \"KeyVaultParameterReferenceSecretRetrieveFailed\",\r\n    \"message\": \"The secret of KeyVault parameter 'password' cannot be retrieved. Http status code: 'Forbidden'. Error message: 'Access denied to first party service.\\r\\nCaller: name=ARM;tid=f8cdef31...;appid=797f4846...;oid=f248a218...;iss=https://sts.windows.net/f8cdef31.../\\r\\nVault: kv-kf-web-shared-fea-ne;location=northeurope'. Please see https://aka.ms/arm-keyvault for usage details.\"\r\n  }\r\n}"
  10.       }
  11.     ]
  12.   }
  13. }

main.bicep:

  1. // Module: Key Vault
  2. module keyVaultModule '../../Bicep.Modules/keyVault.bicep' = {
  3.   name: 'keyVaultDeployment'
  4.   params: {
  5.     application: '${application}-shared'
  6.     environment: environment
  7.     location: location
  8.     tags: tags
  9.   }
  10.   scope: resourceGroup
  11. }
  13. resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  14.   name: keyVaultModule.outputs.name
  15.   scope: resourceGroup
  16. }
  18. // Module: SQL Server
  19. module databaseServerModule '../../Bicep.Modules/databaseServer.bicep' = {
  20.   name: 'databaseServerDeployment'
  21.   params: {
  22.     application: '${application}-shared'
  23.     environment: environment
  24.     location: location
  25.     tags: tags
  26.     keyVaultName: keyVaultModule.outputs.name
  27.     password: keyVault.getSecret('password-databaseServer-sql-${application}-shared-${environment}-${shortlocation}')
  28.   }
  29.   scope: resourceGroup
  30. }

/keyVault.bicep

  1. // Resource - Function App
  2. resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  3.   name: name
  4.   location: location
  5.   tags: tags
  6.   properties: {
  7.     accessPolicies: [
  8.       {
  9.         objectId: '{ AAD-GRP-Dev-DevOps Object Id }'
  10.         permissions: {
  11.           certificates: [
  12.             'all'
  13.           ]
  14.           keys: [
  15.             'all'
  16.           ]
  17.           secrets: [
  18.             'all'
  19.           ]
  20.           storage: [
  21.             'all'
  22.           ]
  23.         }
  24.         tenantId: subscription().tenantId
  25.       }
  26.       {
  27.         objectId: '{ Windows Azure Service Management API Object Id }'
  28.         permissions: {
  29.           certificates: [
  30.             'all'
  31.           ]
  32.           keys: [
  33.             'all'
  34.           ]
  35.           secrets: [
  36.             'all'
  37.           ]
  38.           storage: [
  39.             'all'
  40.           ]
  41.         }
  42.         tenantId: subscription().tenantId
  43.       }
  44.       {
  45.         objectId: '{ Windows Azure Service Management API Object Id }'
  46.         permissions: {
  47.           certificates: [
  48.             'all'
  49.           ]
  50.           keys: [
  51.             'all'
  52.           ]
  53.           secrets: [
  54.             'all'
  55.           ]
  56.           storage: [
  57.             'all'
  58.           ]
  59.         }
  60.         tenantId: subscription().tenantId
  61.       }
  62.     ]
  63.     sku: {
  64.       family: 'A'
  65.       name: 'standard'
  66.     }
  67.     tenantId: subscription().tenantId
  68.   }
  69. }

Key Vault Access Policies:

The secret of KeyVault parameter '' cannot be retrieved. Http status code: 'Forbidden'. Error message: 'Access denied to first party service

答案1

得分: 4

在 Key Vault 的访问配置中，检查 Azure 资源管理器以进行模板部署，如果需要的话可能还要检查虚拟机。
为 Key Vault 启用模板部署

英文:

In the access configuration of Key Vault check the Azure Resource Manager for template deployment, and probably for VM if needed.
Enable Template deployment for Key Vault

huangapple
  • 本文由 发表于 2023年2月8日 20:45:10
  • 转载请务必保留本文链接：https://go.coder-hub.com/75385993.html
  • azure
  • azure-bicep
  • azure-keyvault
  • azure-service-principal
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定