无法在同一ARM模板部署中创建和引用keyvault机密

Question

{
  "type": "Microsoft.KeyVault/vaults",
  "name": "[variables('KeyVaultName')]",
  "apiVersion": "2015-06-01",
  "location": "[resourceGroup().location]",
  "properties": {
    "enabledForTemplateDeployment": "true",
    "accessPolicies": "[variables('KeyVaultAccessPolicies')]",
    "tenantId": "[parameters('TenantId')]",
    "sku": {
      "name": "Standard",
      "family": "A"
    }
  }
},
{
  "type": "Microsoft.KeyVault/vaults/secrets",
  "name": "[concat(variables('KeyVaultName'), '/secretname')]",
  "apiVersion": "2015-06-01",
  "properties": {
    "value": "<a randomised value>"
  },
  "dependsOn": [
    "[concat('Microsoft.KeyVault/vaults/', variables('KeyVaultName'))]"
  ]
},
{
  "apiVersion": "2017-05-10",
  "name": "deploy",
  "type": "Microsoft.Resources/deployments",
  "resourceGroup": "<another resource group>",
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "<my linked template>",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "SQLServerAdminPasswordSecretName": {
        "value": "secretname"
      }
    }
  },
  "dependsOn": [
    "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('KeyVaultName'), 'secretname')]"
  ]
}

{
    "apiVersion": "2017-05-10",
    "name": "sql-server-deployment",
    "type": "Microsoft.Resources/deployments",
    "properties": {
        "mode": "Incremental",
        "templateLink": {
            "uri": "<another linked tempalate>",
            "contentVersion": "1.0.0.0"
        },
        "parameters": {
            "SQLServerName": {
                "value": "[variables('SQLServerName')]"
            },
            "SQLServerAdminPassword": {
                "reference": {
                    "keyVault": {
                        "id": "[resourceId(parameters('ParentResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('ParentKeyVaultName'))]"
                    },
                    "secretName": "[parameters('SQLServerAdminPasswordSecretName')]"
                }
            }
        }
    }
}

这个引用目前扼杀了我的整个部署，说：

“找不到指定得KeyVault'/subscriptions/[订阅id]/ResourceGroups/[父资源组]/Providers/Microsoft.KeyVault/Vaults/[my KeyVault]'.”

如果删除链接模板中的Keyvault引用，错误就会消失。

Answer 1

参数引用是在“编译”时评估的（即验证），因此验证模板时存储库确实需要存在。您可以通过嵌套几个层次的深度并使用来自嵌套部署的输出引用来实现这一点。你需要做这样的事情：

• 嵌套存储库设置并输出VaultiD
• 将SQL Server部署嵌套到“Level 1”嵌套中
• 在上述项目符号的参数中，引用步骤1中的输出
• 用从“Level 1”嵌套中的vaultId构造的参数引用嵌套另一个部署

我对你为什么要这么做很感兴趣...通常，vault引用用于保护纯文本/JSON之外的秘密。由于您在顶层将secret值传递到部署中，因此您已经拥有了该值。因为你已经有了它，所以没有理由从金库里引用它...