在C#.NET中使用MSI访问Azure密钥库

Question

由于我是Azure的新手，这个问题可能很傻。我正在尝试构建一个提供和管理虚拟机集群的服务。出于安全考虑，我不想在每个集群上放一些敏感数据。因此我决定为每个集群提供一个Azure密钥库来存储这些数据，并创建一个MSI（managed identity）并分派给集群的每个节点，这样vm就可以访问密钥库来获取机密。

在服务端，我需要提供vms、密钥库和MSI。将MSI分配给每个VM，同时授予MSI访问AKV的权限。以下是我的问题：

null

Answer 1

1.系统分配的托管标识和用户分配的托管标识有什么区别？

根据我的研究，系统分配的托管标识是直接在Azure服务实例上启用的。系统分配的标识的生命周期直接绑定到启用它的Azure服务实例。如果实例被删除，Azure会自动清理Azure AD中的凭据和标识。

但是，用户分配的托管标识是作为独立的Azure资源创建的。创建标识后，可以将标识分配给一个或多个Azure服务实例。用户分配的标识的生命周期与分配给它的Azure服务实例的生命周期是分开管理的。

Azure CLI

az login
az identity create -g <RESOURCE GROUP> -n <USER ASSIGNED IDENTITY NAME>

Azure REST API A。使用Azure CLI获取访问令牌

az login
az account get-access-token

b.调用rest api

curl 'https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroup
s/<RESOURCE GROUP>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<USER ASSIGNED IDENTITY NAME>?api-version=2015-08-31-preview' -X PUT -d '{"loc
ation": "<LOCATION>"}' -H "Content-Type: application/json" -H "Authorization: Bearer <ACCESS TOKEN>"

az login
az account get-access-token

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}?api-version=2018-02-14
Header :
   Content-Type: application/json
   Authorization: Bearer <ACCESS TOKEN>
Body

  {
  "location": "westus",
  "properties": {
    "tenantId": "<your tenant id>",
    "sku": {
      "family": "A",
      "name": "standard"
    },
    "accessPolicies": [
      {
        "tenantId": "<your tenant id>",
        "objectId": "<the object id of the MSI>",
        "permissions": {
          "keys": [
            "encrypt",
            "decrypt",
            "wrapKey",
            "unwrapKey",
            "sign",
            "verify",
            "get",
            "list",
            "create",
            "update",
            "import",
            "delete",
            "backup",
            "restore",
            "recover",
            "purge"
          ],
          "secrets": [
            "get",
            "list",
            "set",
            "delete",
            "backup",
            "restore",
            "recover",
            "purge"
          ],
          "certificates": [
            "get",
            "list",
            "delete",
            "create",
            "import",
            "update",
            "managecontacts",
            "getissuers",
            "listissuers",
            "setissuers",
            "deleteissuers",
            "manageissuers",
            "recover",
            "purge"
          ]
        }
      }
    ],
    "enabledForDeployment": true,
    "enabledForDiskEncryption": true,
    "enabledForTemplateDeployment": true
  }
}

az login
az ad sp create-for-rbac -n "MyApp" --role contributor --sdk-auth

b.代码。更多详情请参阅示例

// please install package  Microsoft.Azure.Management.Fluent
var credentials = SdkContext.AzureCredentialsFactory
    .FromServicePrincipal(<the sp app id>,
    <the sp password>,
    tenantId, 
    AzureEnvironment.AzureGlobalCloud);
var azure = Microsoft.Azure.Management.Fluent.Azure
    .Configure()
    .Authenticate(credentials)
    .WithSubscription ("<your subscription id>");
var vault =await azure.Vaults.Define("")
                       .WithRegion(Region.AsiaSouthEast)
                       .WithExistingResourceGroup("groupname")
                       .DefineAccessPolicy()
                              .ForObjectId("the object id of msi")
                              .AllowCertificateAllPermissions()
                              .AllowKeyAllPermissions()
                              .AllowSecretAllPermissions()
                              .Attach()
                       .WithDeploymentEnabled()
                       .WithDiskEncryptionEnabled()
                       .WithTemplateDeploymentEnabled()
                       .WithSku(Microsoft.Azure.Management.KeyVault.Fluent.Models.SkuName.Standard)
                       .CreateAsync()