Question

尝试预配函数应用，但同时在具有依赖项的密钥保管库中创建访问策略。不确定这是否可能。我希望它能创建应用程序，然后添加访问策略，然后更新功能配置。

但是我收到以下错误：

##[error]Deployment template validation failed: 'The template resource 'my-keyvault/add' at line '1' and column '2933' is not valid: Unable to evaluate template language function 'resourceId': the type 'Microsoft.Web/sites/functions' requires '2' resource name argument(s). Please see https://aka.ms/arm-template-expressions/#resourceid for usage details.. Please see https://aka.ms/arm-template-expressions for usage details.'.

这是模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVault.name": {
      "type": "string"
    },
    "environment": {
      "type": "string"
    },
    "functionAppName": {
      "type": "string"
    },
    "appInsightsKey": {
      "type": "string"
    },
    "location": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Web/serverfarms",
      "apiVersion": "2020-06-01",
      "name": "[parameters('functionAppName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Y1",
        "tier": "Dynamic"
      },
      "properties": {
        "name": "[parameters('functionAppName')]",
        "computeMode": "Dynamic"
      }
    },
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2020-06-01",
      "name": "[parameters('functionAppName')]",
      "location": "[parameters('location')]",
      "kind": "functionapp",
      "identity": {
        "type": "SystemAssigned"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', parameters('functionAppName'))]"
      ],
      "properties": {
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('functionAppName'))]",
        "httpsOnly": true
      },
      "resources": [
        {
          "apiVersion": "2020-06-01",
          "name": "web",
          "type": "config",
          "dependsOn": [
            "[resourceId('Microsoft.Web/Sites', parameters('functionAppName'))]"
          ],
          "properties": {
            "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('functionAppName'))]"
          }
        },
        {
          "apiVersion": "2020-06-01",
          "type": "config",
          "name": "appsettings",
          "dependsOn": [
            "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]",
            "[resourceId('Microsoft.KeyVault/vaults/', parameters('keyVault.Name'))]"
          ],
          "properties": {
            "AzureWebJobsStorage": "[concat('@Microsoft.KeyVault(SecretUri=https://', parameters('keyVault.Name'), '.vault.azure.net/secrets/StorageAccountConnectionString/)')]",
            "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('@Microsoft.KeyVault(SecretUri=https://', parameters('keyVault.Name'), '.vault.azure.net/secrets/StorageAccountConnectionString/)')]",
            "WEBSITE_CONTENTSHARE": "[toLower(parameters('functionAppName'))]",
            "FUNCTIONS_EXTENSION_VERSION": "~3",
            "WEBSITE_NODE_DEFAULT_VERSION": "~12",
            "WEBSITE_RUN_FROM_PACKAGE": "1",
            "APPINSIGHTS_INSTRUMENTATIONKEY": "[parameters('appInsightsKey')]",
            "FUNCTIONS_WORKER_RUNTIME": "dotnet"
          }
        }
      ]
    },
    {
      "type": "Microsoft.KeyVault/vaults/accessPolicies",
      "apiVersion": "2019-09-01",
      "name": "[concat(parameters('keyVault.name'), '/add')]",
      "dependsOn": [
        "[resourceId('my-resource-group', 'Microsoft.Web/sites/functions', parameters('functionAppName'))]"
      ],
      "properties": {
        "accessPolicies": [
          {
            "tenantId": "[subscription().tenantId]",
            "objectId": "[reference(resourceId('Microsoft.Web/sites', parameters('functionAppName')), '2019-08-01', 'full').identity.principalId]",
            "permissions": {
              "secrets": [
                "get",
                "list"
              ]
            }
          }
        ]
      }
    }    
  ]
}

Answer 1

资源类型 Microsoft.Web/sites/functions 表示函数应用中的函数资源。它是 Microsoft.Web/sites 中的子资源类型。因此，如果我们想使用函数 resourceId 来获取模板中资源的 id，则表达式应该类似于 "[resourceId('my-resource-group', 'Microsoft.Web/sites/functions', parameters('functionAppName'),<function name>)]"。

另外，如果我们只是想获取函数应用的id，那么表达式应该像"[resourceId('my-resource-group', 'Microsoft.Web/sites', parameters('functionAppName'))]"。

详情请参考

https://docs.microsoft.com/en-us/azure/azure-functions/functions-infrastructure-as-code

https://docs.microsoft.com/en-us/azure/templates/microsoft.web/sites/functions?tabs=json

https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-resource?tabs=json#remarks-3

使用 DependsOn Azure 函数添加 KeyVault 访问策略

1 个答案: