Question

我构建了服务结构应用程序，并且想保护Azure Key保管库中的机密，我执行了与应用程序服务相同的步骤，但是它不起作用，很欣赏重放。

对于应用服务： 1.在主要方法上配置密钥库 2.在应用服务上启用分配的托管身份，该身份已应用到SF的规模集。 3.在密钥库上添加访问策略。

Answer 1

1）Azure配置（VM缩放集+密钥保管库）：

Login-AzureRmAccount # Login into Azure account

$targetRg = "testfabric-rg" # Target resource group name
$targetVmss = "jxewcyinq" # Target virtual machine scale set name
$targetKeyVault = "az-ure-two20190115153549" # Target Key Vault name

# 1. Enable Managed Identity for target Virtual Machine Scale Set
Update-AzureRmVmss `
    -ResourceGroupName $targetRg `
    -VMScaleSetName $targetVmss `
    -IdentityType SystemAssigned
# 2. Retrieve virtual machine scale set
$vmss = Get-AzureRmVmss `
    -ResourceGroupName $targetRg `
    -Name $targetVmss
# 3. Create new Key vault access policy allowing Virtual Machine Scale Set to read secrets by their IDs
Set-AzureRmKeyVaultAccessPolicy `
    -VaultName $targetKeyVault `
    -ObjectId $vmss.Identity.PrincipalId `
    -PermissionsToSecrets Get # set only necessary permissions!

2）使用C＃时获取密钥库机密：

// https://www.nuget.org/packages/Microsoft.Azure.KeyVault/
using Microsoft.Azure.KeyVault;
// https://www.nuget.org/packages/Microsoft.Azure.Services.AppAuthentication
using Microsoft.Azure.Services.AppAuthentication;

public async Task<string> GetSecretById(string id)
{
    // URL of the target Key Vault
    var keyVaultUrl = "https://az-ure-two20190115153549.vault.azure.net";

    var azureServiceTokenProvider = new AzureServiceTokenProvider();

    var keyVaultClient = new KeyVaultClient(
        new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));

    var secret = await keyVaultClient.GetSecretAsync($"{keyVaultUrl}/secrets/{id}");

    return secret.Value;
}

从Service Fabric访问Azure Key Vault上的机密

1 个答案: