没有秘密的用户、组或应用程序获得密钥库的权限

Question

我有下面的脚本在一个发布管道中执行:

$keyVaultName = "brajzorekeyvault"
$keyVaultMySecret =  az keyvault secret show --name "MySecret" --vault-name $keyVaultName
$keyVaultMySecretId = ($keyVaultMySecret | ConvertFrom-Json).id
$location = "northeurope"
$resourceGroup = "Test"
$appServicePlan = "brajzoreappserviceplan"
$appServiceName = "brajzoreappservice"

Write-Host "Create resource group $resourceGroup"

az group create `
-l $location `
-n $resourceGroup

Write-Host "Create App Service Plan $appServicePlan"

az appservice plan create `
--resource-group $resourceGroup `
--name $appServicePlan `
--location $location `
--sku S1 `
--number-of-workers 2

Write-Host "Create App Service $appServiceName"

az webapp create `
--name $appServiceName `
--resource-group $resourceGroup `
--plan $appServicePlan

Write-Host "Create App Service Identity $appServiceName"

$appServiceIdentity = az webapp identity assign `
--name $appServiceName `
--resource-group $resourceGroup

$objectId = ($appServiceIdentity | ConvertFrom-Json).principalId
Write-Host "Created identity $objectId"

Write-Host "Assigned $appServiceIdentity"

Write-Host "Azure az keyvault set-policy using $objectId"

az keyvault set-policy `
--name $keyVaultName `
--secret-permissions get list `
--output none `
--object-id $objectId

当我运行这个管道时，我得到以下错误:

2021-03-08T12:01:58.8032755Z ERROR: The user, group or application 'appid=***;oid=8e00ef3a-edb2-4aa7-88cd-8b03ea083454;iss=https://sts.windows.net/***/' does not have secrets get permission on key vault 'brajzorekeyvault;location=northeurope'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287

我做错了什么?我必须在密钥库中设置什么样的策略才能使管道不抛出错误?

在principal列表中找不到对象Id为8e00ef3a-edb2-4aa7-88cd-8b03ea083454的principal

Answer 1

在主体列表中找不到对象Id为8e00ef3a-edb2-4aa7-88cd-8b03ea083454的主体

该对象ID可以是AAD组或用户的对象ID，而不是主对象ID本身。

Answer 2

您的脚本运行良好。我很好奇的用户/服务主体，你正在使用登录到azure这个脚本/管道运行。是否同一用户/SP有权访问该密钥库以设置权限?