Azure Powershell Set-AzKeyVaultAccessPolicy命令设置对数据工厂的访问策略

Question

当我尝试通过Powershell将访问策略（Azure关键值）提供给我的Azure数据工厂时 我遇到错误

Set-AzKeyVaultAccessPolicy：操作返回了无效的状态码 'BadRequest'在第64行：1 char + Set-AzKeyVaultAccessPolicy -VaultName $ keyvaultname -ServicePrincipal ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~ + CategoryInfo：CloseError ：( :) [Set-AzKeyVaultAccessPolicy]，GraphErrorException + FullyQualifiedErrorId：Microsoft.Azure.Commands.KeyVault.SetAzureKeyVau ltAccessPolicy

任何帮助将不胜感激...

预先感谢

这是我要执行的脚本

## select subcription

$subcription='Visual Studio Enterprise – MPN'

Select-AzSubscription $subcription


## create a new resource group

$resourcegroupname=”gho-rg-dev”
$location="eastus"

$rg=New-AzResourceGroup `
        -Name $resourcegroupname `
        -Location $location


## create the storage account


$storageAccountName = "ghostoragelab"
$skuName = "Standard_LRS"

$storageAccount = New-AzStorageAccount -ResourceGroupName $resourcegroupname `
                     -Name $storageAccountName `
                     -Location $location `
                     -SkuName $skuName

$storageaccountkey=(Get-AzStorageAccountkey -ResourceGroupName $resourcegroupname -Name $storageAccount.StorageAccountName).Value[0]


##create azure data factory

$datafactoryname='lab-factory-dev'

$df= New-AzDataFactoryV2 `
        -ResourceGroupName $resourcegroupname -Name $datafactoryname -Location $location




## creating the azure key vault

$keyvaultname="labkeydev"

$keyvault=New-AzKeyVault -ResourceGroupName $resourcegroupname -Name $keyvaultname `
        -Location $location

# creating the secret key in keyvault

Set-AzKeyVaultSecret -VaultName $keyvaultname -Name "secret-access-key"`
 -SecretValue(ConvertTo-SecureString -String $storageaccountkey -AsPlainText -Force)

#Give access policy to the datafactory thorugh keyvault

*## this is where script is failing*

Set-AzKeyVaultAccessPolicy -VaultName $keyvaultname -ServicePrincipalName $df.DataFactoryId -PermissionsToSecrets Get

Answer 1

我想您想将MSI of the data factory添加到密钥池的Access policies中。

您收到错误消息是因为您在此使用了-ServicePrincipalName $df.DataFactoryId 命令Set-AzKeyVaultAccessPolicy，$df.DataFactoryId是数据工厂的resource id，您需要的是MSI的Application ID(Client ID)。

因此，如果要使用-ServicePrincipalName参数，则命令应为：

$appId = (Get-AzADServicePrincipal -ObjectId $df.Identity.PrincipalId).ApplicationId
Set-AzKeyVaultAccessPolicy -VaultName joykeyvault -ServicePrincipalName $appId -PermissionsToSecrets get

---

上面的命令需要在Azure AD中获取服务主体的权限，如果没有此权限，则可以使用命令（我建议您使用此命令）：

Set-AzKeyVaultAccessPolicy -VaultName joykeyvault -ObjectId $df.Identity.PrincipalId -PermissionsToSecrets get -BypassObjectIdValidation

如果已经创建了数据工厂，则可以使用Get-AzDataFactoryV2来获取它，然后将其添加到访问策略中。

$datafactory = Get-AzDataFactoryV2 -ResourceGroupName <group name> -Name <factory name>
Set-AzKeyVaultAccessPolicy -VaultName joykeyvault -ObjectId $datafactory.Identity.PrincipalId -PermissionsToSecrets get -BypassObjectIdValidation