Je cherche à copier un seul certificat de Test1-KV vers New-KV avec le code suivant, mais je reçois l'erreur suivante:

Azurerm_key_vault_certificate.new-cert: Création ...

Erreur: keyvault.BaseClient # CreateCertificate: échec de la réponse à la demande: StatusCode = 400 - Erreur d'origine: autorest / azure: le service a renvoyé une erreur. Status = 400 Code = "BadParameter" Message = "La politique de propriété a une valeur non valide \ r \ n"

À la ligne 91 de resources.tf, dans la ressource "azurerm_key_vault_certificate" "new-cert": 91: resource "azurerm_key_vault_certificate" "new-cert" {

Code:

data "azurerm_key_vault" "existing" {
  name                = "Test1-KV"
  resource_group_name = "Test1-RG"
  
}

data "azurerm_key_vault_certificate" "new-cert" {
  name          = "new-cert"
  key_vault_id  = data.azurerm_key_vault.existing.id
}

resource "azurerm_key_vault_certificate" "new-cert" {
  name         = "new-cert"
  key_vault_id = azurerm_key_vault.new-kv.id

  certificate_policy {
    issuer_parameters {
      name = "My CA"
    }
    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }
    secret_properties {
      content_type = "application/x-pkcs12"
    }
  }
}

// modifier la partie: voici mon code complet. pour copier les secrets et le certificat dans New-KV à partir de Test1-KV.

provider "azurerm" {
    version = "~>2.14.0"
    features {}
}

resource "azurerm_resource_group" "main" {
  name     = "${var.prefix}-RG"
  location = var.location
}

# --- Get reference to logged on Azure subscription ---
data "azurerm_client_config" "current" {}


resource "azurerm_key_vault" "NewKV" {
  name                        = "New-KV"
  location                    = azurerm_resource_group.main.location
  resource_group_name         = azurerm_resource_group.main.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_enabled         = true
  purge_protection_enabled    = false


  sku_name = "standard"
  

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    certificate_permissions = [
      "create",
      "delete",
      "deleteissuers",
      "get",
      "getissuers",
      "import",
      "list",
      "listissuers",
      "managecontacts",
      "manageissuers",
      "setissuers",
      "update",
    ]

    key_permissions = [
      "backup",
      "create",
      "decrypt",
      "delete",
      "encrypt",
      "get",
      "import",
      "list",
      "purge",
      "recover",
      "restore",
      "sign",
      "unwrapKey",
      "update",
      "verify",
      "wrapKey",
    ]

    secret_permissions = [
      "backup",
      "delete",
      "get",
      "list",
      "purge",
      "recover",
      "restore",
      "set",
    ]
 

  }
}
# -------------------- Importing Secrets from Central Key Vault to New-KV ---------------------------

# --- Defining where to import secrets ---
data "azurerm_key_vault" "existing" {
  name                = "Test1-KV"
  resource_group_name = "Test1-RG"
  
}

# --- telling what to import ---
data "azurerm_key_vault_secret" "Cred" {
  name         = "Cred"
  key_vault_id = data.azurerm_key_vault.existing.id
}

# --- defining where to import ---
resource "azurerm_key_vault_secret" "Cred" {
  name         = "Cred"
  value        = data.azurerm_key_vault_secret.Cred.value
  key_vault_id = azurerm_key_vault.NewKV.id
}

# ----------------------- Importing Certificate from Central Key Vault Certificates ----------------------------------

// It stores the actual cert as a secret
data "azurerm_key_vault_secret" "New-Cert" {
  name         = "New-Cert"
  key_vault_id = data.azurerm_key_vault.existing.id
}

data "azurerm_key_vault_certificate" "New-Cert" {
  name         = "New-Cert"
  key_vault_id = data.azurerm_key_vault.existing.id
}

resource "azurerm_key_vault_certificate" "New-Cert" {
  name         = "New-Cert"
  key_vault_id = azurerm_key_vault.NewKV.id

  certificate {
    contents = data.azurerm_key_vault_secret.New-Cert.value
  }

  certificate_policy {
    issuer_parameters {
      name = "My Company CA"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      trigger {
        days_before_expiry = 30
      }
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      # Server Authentication = 1.3.6.1.5.5.7.3.1
      # Client Authentication = 1.3.6.1.5.5.7.3.2
      extended_key_usage = ["1.3.6.1.5.5.7.3.1"]

      key_usage = [
               
        "digitalSignature",
        "keyEncipherment",
      ]

      subject_alternative_names {
        dns_names = ["hello-world.io", "Hello-World"]
      }

      subject            = "CN=New-Cert"
      validity_in_months = 61
    }
  }
}
0
Muhammad Zaman 27 août 2020 à 14:10

2 réponses

Meilleure réponse

Le problème est résolu en ajoutant le code ci-dessous

data "azurerm_key_vault" "New-KV" {
  name                = "New-KV"
  resource_group_name = "New-RG"
}

data "azurerm_key_vault_secret" "Test1-KV" {
  name         = "Cert"
  key_vault_id = data.azurerm_key_vault.existing.id
}

data "azurerm_key_vault_certificate" "Cert" {
  name         = "Cert"
  key_vault_id = data.azurerm_key_vault.existing.id
}

resource "azurerm_key_vault_certificate" "Cert" {
  name         = "Cert"
  key_vault_id = data.azurerm_key_vault.New-KV.id


 certificate {
    contents = data.azurerm_key_vault_secret.Test1-KV.value
  }

certificate_policy {
    issuer_parameters {
      name = "self" (instead using original issuer use self)
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }


  }

  }
0
Muhammad Zaman 1 sept. 2020 à 14:03

Je ne sais pas exactement quelle est votre erreur, mais votre code n'est pas fonctionnel pour ce que vous essayez de faire. Je fournis un exemple de la première exécution pour créer un certificat et de la deuxième exécution pour l'importer dans un nouveau kv. L'astuce consiste à rechercher le secret généré par le certificat pour l'importer. Je valide le processus travaillé via les empreintes digitales.

C'est le premier main.tf à générer kv et cert initiaux

provider "azurerm" {
  version = "~>2.23.0"
  features {}
}

data "azurerm_client_config" "current" {
}

resource "azurerm_resource_group" "example" {
  name     = "key-vault-certificate-example"
  location = "East US"
}

output "certificate_thumbprint" {
  value = azurerm_key_vault_certificate.example.thumbprint
}

resource "azurerm_key_vault" "example" {
  name                = "pearceckvcertexample"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  tenant_id           = data.azurerm_client_config.current.tenant_id

  sku_name = "standard"

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    certificate_permissions = [
      "create",
      "delete",
      "deleteissuers",
      "get",
      "getissuers",
      "import",
      "list",
      "listissuers",
      "managecontacts",
      "manageissuers",
      "setissuers",
      "update",
    ]

    key_permissions = [
      "backup",
      "create",
      "decrypt",
      "delete",
      "encrypt",
      "get",
      "import",
      "list",
      "purge",
      "recover",
      "restore",
      "sign",
      "unwrapKey",
      "update",
      "verify",
      "wrapKey",
    ]

    secret_permissions = [
      "backup",
      "delete",
      "get",
      "list",
      "purge",
      "recover",
      "restore",
      "set",
    ]
  }

  tags = {
    environment = "Production"
  }
}

resource "azurerm_key_vault_certificate" "example" {
  name         = "generated-cert"
  key_vault_id = azurerm_key_vault.example.id

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      trigger {
        days_before_expiry = 30
      }
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      # Server Authentication = 1.3.6.1.5.5.7.3.1
      # Client Authentication = 1.3.6.1.5.5.7.3.2
      extended_key_usage = ["1.3.6.1.5.5.7.3.1"]

      key_usage = [
        "cRLSign",
        "dataEncipherment",
        "digitalSignature",
        "keyAgreement",
        "keyCertSign",
        "keyEncipherment",
      ]

      subject_alternative_names {
        dns_names = ["internal.contoso.com", "domain.hello.world"]
      }

      subject            = "CN=hello-world"
      validity_in_months = 12
    }
  }
}

C'est le deuxième main.tf (état différent), pour générer un deuxième kv et importer le cert du secret dans le coffre d'origine.

provider "azurerm" {
  version = "~>2.23.0"
  features {}
}

data "azurerm_client_config" "current" {
}

data "azurerm_key_vault" "example" {
  name                = "pearceckvcertexample"
  resource_group_name = "key-vault-certificate-example"
}

// It stores the actual cert as a secret
data "azurerm_key_vault_secret" "example" {
  name         = "generated-cert"
  key_vault_id = data.azurerm_key_vault.example.id
}

data "azurerm_key_vault_certificate" "example" {
  name         = "generated-cert"
  key_vault_id = data.azurerm_key_vault.example.id
}

output "certificate_thumbprint" {
  value = data.azurerm_key_vault_certificate.example.thumbprint
}

output "certificate_thumbprint2" {
  value = azurerm_key_vault_certificate.example.thumbprint
}

resource "azurerm_resource_group" "example" {
  name     = "key-vault-certificate-example2"
  location = "East US"
}

resource "azurerm_key_vault" "example" {
  name                = "pearceckvcertexample2"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  tenant_id           = data.azurerm_client_config.current.tenant_id

  sku_name = "standard"

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    certificate_permissions = [
      "create",
      "delete",
      "deleteissuers",
      "get",
      "getissuers",
      "import",
      "list",
      "listissuers",
      "managecontacts",
      "manageissuers",
      "setissuers",
      "update",
    ]

    key_permissions = [
      "backup",
      "create",
      "decrypt",
      "delete",
      "encrypt",
      "get",
      "import",
      "list",
      "purge",
      "recover",
      "restore",
      "sign",
      "unwrapKey",
      "update",
      "verify",
      "wrapKey",
    ]

    secret_permissions = [
      "backup",
      "delete",
      "get",
      "list",
      "purge",
      "recover",
      "restore",
      "set",
    ]
  }

  tags = {
    environment = "Production"
  }
}

resource "azurerm_key_vault_certificate" "example" {
  name         = "generated-cert"
  key_vault_id = azurerm_key_vault.example.id

  certificate {
    contents = data.azurerm_key_vault_secret.example.value
  }

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      trigger {
        days_before_expiry = 30
      }
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      # Server Authentication = 1.3.6.1.5.5.7.3.1
      # Client Authentication = 1.3.6.1.5.5.7.3.2
      extended_key_usage = ["1.3.6.1.5.5.7.3.1"]

      key_usage = [
        "cRLSign",
        "dataEncipherment",
        "digitalSignature",
        "keyAgreement",
        "keyCertSign",
        "keyEncipherment",
      ]

      subject_alternative_names {
        dns_names = ["internal.contoso.com", "domain.hello.world"]
      }

      subject            = "CN=hello-world"
      validity_in_months = 12
    }
  }
}

Sortie de la course:

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Outputs:

certificate_thumbprint = 8ADC0C8B2255E7B19FBEFC3B348B7E075D5AB1DA
certificate_thumbprint2 = 8ADC0C8B2255E7B19FBEFC3B348B7E075D5AB1DA
0
Christian Pearce 27 août 2020 à 16:11