Skip to content

Commit 5a3e0f5

Browse files
dlepowdlepow
committed
[APIM] Update template for system-assigned managed identity
1 parent 050a60f commit 5a3e0f5

File tree

1 file changed

+112
-85
lines changed

1 file changed

+112
-85
lines changed

‎articles/api-management/api-management-howto-use-managed-service-identity.md

Lines changed: 112 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -139,81 +139,93 @@ To configure an access policy using the portal:
139139
### <a name="use-ssl-tls-certificate-from-azure-key-vault"></a>Obtain a custom TLS/SSL certificate for the API Management instance from Azure Key Vault
140140
You can use the system-assigned identity of an API Management instance to retrieve custom TLS/SSL certificates stored in Azure Key Vault. You can then assign these certificates to custom domains in the API Management instance. Keep these considerations in mind:
141141

142-
- The content type of the secret must be *application/x-pkcs12*.
142+
- The content type of the secret must be *application/x-pkcs12*. Learn more about custom domain [certificate requirements](configure-custom-domain.md?tabs=key-vault#domain-certificate-options).
143143
- Use the Key Vault certificate secret endpoint, which contains the secret.
144144

145145
> [!Important]
146146
> If you don't provide the object version of the certificate, API Management will automatically obtain the newer version of the certificate within four hours after it's updated in Key Vault.
147147
148-
The following example shows an Azure Resource Manager template that contains the following steps:
148+
The following example shows an Azure Resource Manager template that uses the system-assigned managed identity of an API Management service instance to retrieve a custom domain certificate from Key Vault.
149+
150+
#### Prerequisites
151+
152+
* An API Management service instance configured with a system-assigned managed identity. To create the instance, you can use an [Azure Quickstart Template](https://azure.microsoft.com/en-us/resources/templates/api-management-create-with-msi/).
153+
* An Azure Key Vault instance in the same resource group, hosting a certificate that will be used as a custom domain certificate in API Management.
149154

150-
1. Create an API Management instance with a managed identity.
151-
2. Update the access policies of an Azure Key Vault instance and allow the API Management instance to obtain secrets from it.
152-
3. Update the API Management instance by setting a custom domain name through a certificate from the Key Vault instance.
155+
The following template contains the following steps. When you run the template, provide parameter values appropriate for your environment.
156+
157+
1. Update the access policies of the Azure Key Vault instance and allow the API Management instance to obtain secrets from it.
158+
1. Update the API Management instance by setting a custom domain name through the certificate from the Key Vault instance.
153159

154160
```json
155161
{
156-
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
157-
"contentVersion": "1.0.0.0",
158-
"parameters": {
159-
"publisherEmail": {
160-
"type": "string",
161-
"minLength": 1,
162-
"metadata": {
163-
"description": "The email address of the owner of the service"
164-
}
165-
},
166-
"publisherName": {
162+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
163+
"contentVersion": "1.0.0.0",
164+
"parameters": {
165+
"apiManagementServiceName": {
167166
"type": "string",
168-
"defaultValue": "Contoso",
169-
"minLength": 1,
170-
"metadata": {
171-
"description": "The name of the owner of the service"
172-
}
173-
},
174-
"sku": {
175-
"type": "string",
176-
"allowedValues": ["Developer",
177-
"Standard",
178-
"Premium"],
179-
"defaultValue": "Developer",
180-
"metadata": {
181-
"description": "The pricing tier of this API Management instance"
182-
}
183-
},
184-
"skuCount": {
185-
"type": "int",
186-
"defaultValue": 1,
187-
"metadata": {
188-
"description": "The instance size of this API Management instance."
167+
"minLength": 8,
168+
"metadata":{
169+
"description": "The name of the API Management service"
189170
}
190171
},
172+
"publisherEmail": {
173+
"type": "string",
174+
"minLength": 1,
175+
"metadata": {
176+
"description": "The email address of the owner of the service"
177+
}
178+
},
179+
"publisherName": {
180+
"type": "string",
181+
"minLength": 1,
182+
"metadata": {
183+
"description": "The name of the owner of the service"
184+
}
185+
},
186+
"sku": {
187+
"type": "string",
188+
"allowedValues": ["Developer",
189+
"Standard",
190+
"Premium"],
191+
"defaultValue": "Developer",
192+
"metadata": {
193+
"description": "The pricing tier of this API Management service"
194+
}
195+
},
196+
"skuCount": {
197+
"type": "int",
198+
"defaultValue": 1,
199+
"metadata": {
200+
"description": "The instance size of this API Management service."
201+
}
202+
},
191203
"keyVaultName": {
192204
"type": "string",
193205
"metadata": {
194-
"description": "Name of the vault"
195-
}
196-
},
197-
"proxyCustomHostname1": {
198-
"type": "string",
199-
"metadata": {
200-
"description": "Gateway custom hostname."
206+
"description": "Name of the key vault"
201207
}
202208
},
203-
"keyVaultIdToCertificate": {
204-
"type": "string",
205-
"metadata": {
206-
"description": "Reference to the Key Vault certificate. https://contoso.vault.azure.net/secrets/contosogatewaycertificate."
207-
}
208-
}
209-
},
210-
"variables": {
211-
"apiManagementServiceName": "[concat('apiservice', uniqueString(resourceGroup().id))]",
212-
"apimServiceIdentityResourceId": "[concat(resourceId('Microsoft.ApiManagement/service', variables('apiManagementServiceName')),'/providers/Microsoft.ManagedIdentity/Identities/default')]"
213-
},
214-
"resources": [{
209+
"proxyCustomHostname1": {
210+
"type": "string",
211+
"metadata": {
212+
"description": "Gateway custom hostname 1. Example: api.contoso.com"
213+
}
214+
},
215+
"keyVaultIdToCertificate": {
216+
"type": "string",
217+
"metadata": {
218+
"description": "Reference to the key vault certificate. Example: https://contoso.vault.azure.net/secrets/contosogatewaycertificate"
219+
}
220+
}
221+
},
222+
"variables": {
223+
"apimServiceIdentityResourceId": "[concat(resourceId('Microsoft.ApiManagement/service', parameters('apiManagementServiceName')),'/providers/Microsoft.ManagedIdentity/Identities/default')]"
224+
},
225+
"resources": [
226+
{
215227
"apiVersion": "2021-08-01",
216-
"name": "[variables('apiManagementServiceName')]",
228+
"name": "[parameters('apiManagementServiceName')]",
217229
"type": "Microsoft.ApiManagement/service",
218230
"location": "[resourceGroup().location]",
219231
"tags": {
@@ -233,43 +245,58 @@ The following example shows an Azure Resource Manager template that contains the
233245
{
234246
"type": "Microsoft.KeyVault/vaults/accessPolicies",
235247
"name": "[concat(parameters('keyVaultName'), '/add')]",
236-
"apiVersion": "2015-06-01",
237-
"dependsOn": [
238-
"[resourceId('Microsoft.ApiManagement/service', variables('apiManagementServiceName'))]"
239-
],
248+
"apiVersion": "2018-02-14",
240249
"properties": {
241250
"accessPolicies": [{
242-
"tenantId": "[reference(variables('apimServiceIdentityResourceId'), '2015-08-31-PREVIEW').tenantId]",
243-
"objectId": "[reference(variables('apimServiceIdentityResourceId'), '2015-08-31-PREVIEW').principalId]",
251+
"tenantId": "[reference(variables('apimServiceIdentityResourceId'), '2018-11-30').tenantId]",
252+
"objectId": "[reference(variables('apimServiceIdentityResourceId'), '2018-11-30').principalId]",
244253
"permissions": {
245254
"secrets": ["get", "list"]
246255
}
247256
}]
248257
}
249258
},
250-
{
251-
"apiVersion": "2017-05-10",
259+
{
260+
"apiVersion": "2021-04-01",
261+
"type": "Microsoft.Resources/deployments",
252262
"name": "apimWithKeyVault",
253-
"type": "Microsoft.Resources/deployments",
254-
"dependsOn": [
255-
"[resourceId('Microsoft.ApiManagement/service', variables('apiManagementServiceName'))]"
263+
"dependsOn": [
264+
"[resourceId('Microsoft.ApiManagement/service', parameters('apiManagementServiceName'))]"
256265
],
257266
"properties": {
258267
"mode": "incremental",
259-
"templateLink": {
260-
"uri": "https://raw.githubusercontent.com/solankisamir/arm-templates/master/basicapim.keyvault.json",
261-
"contentVersion": "1.0.0.0"
262-
},
263-
"parameters": {
264-
"publisherEmail": { "value": "[parameters('publisherEmail')]"},
265-
"publisherName": { "value": "[parameters('publisherName')]"},
266-
"sku": { "value": "[parameters('sku')]"},
267-
"skuCount": { "value": "[parameters('skuCount')]"},
268-
"proxyCustomHostname1": {"value" : "[parameters('proxyCustomHostname1')]"},
269-
"keyVaultIdToCertificate": {"value" : "[parameters('keyVaultIdToCertificate')]"}
270-
}
271-
}
272-
}]
268+
"template": {
269+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
270+
"contentVersion": "1.0.0.0",
271+
"parameters": {},
272+
"resources": [{
273+
"apiVersion": "2021-08-01",
274+
"name": "[parameters('apiManagementServiceName')]",
275+
"type": "Microsoft.ApiManagement/service",
276+
"location": "[resourceGroup().location]",
277+
"tags": {
278+
},
279+
"sku": {
280+
"name": "[parameters('sku')]",
281+
"capacity": "[parameters('skuCount')]"
282+
},
283+
"properties": {
284+
"publisherEmail": "[parameters('publisherEmail')]",
285+
"publisherName": "[parameters('publisherName')]",
286+
"hostnameConfigurations": [{
287+
"type": "Proxy",
288+
"hostName": "[parameters('proxyCustomHostname1')]",
289+
"keyVaultId": "[parameters('keyVaultIdToCertificate')]"
290+
}]
291+
},
292+
"identity": {
293+
"type": "systemAssigned"
294+
}
295+
}]
296+
}
297+
}
298+
}
299+
]
273300
}
274301
```
275302

@@ -292,7 +319,7 @@ API Management is a trusted Microsoft service to the following resources. This a
292319
|Azure Key Vault | [Trusted-access-to-azure-key-vault](../key-vault/general/overview-vnet-service-endpoints.md#trusted-services)|
293320
|Azure Storage | [Trusted-access-to-azure-storage](../storage/common/storage-network-security.md?tabs=azure-portal#trusted-access-based-on-system-assigned-managed-identity)|
294321
|Azure Service Bus | [Trusted-access-to-azure-service-bus](../service-bus-messaging/service-bus-ip-filtering.md#trusted-microsoft-services)|
295-
|Azure Event Hub | [Trused-access-to-azure-event-hub](../event-hubs/event-hubs-ip-filtering.md#trusted-microsoft-services)|
322+
|Azure Event Hubs | [Trused-access-to-azure-event-hub](../event-hubs/event-hubs-ip-filtering.md#trusted-microsoft-services)|
296323

297324
## Create a user-assigned managed identity
298325

@@ -432,13 +459,13 @@ Keep these considerations in mind:
432459
433460
For the complete template, see [API Management with Key Vault based SSL using User Assigned Identity](https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.apimanagement/api-management-key-vault-create/azuredeploy.json).
434461

435-
In this template, you will deploy:
462+
In this template, you'll deploy:
436463

437464
* Azure API Management instance
438465
* Azure user-assigned managed identity
439466
* Azure Key Vault for storing the SSL/TLS certificate
440467

441-
To run the deployment automatically, click the following button:
468+
To run the deployment automatically, select the following button:
442469

443470
[![Deploy to Azure](../media/template-deployments/deploy-to-azure.svg)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.apimanagement%2Fapi-management-key-vault-create%2Fazuredeploy.json)
444471

0 commit comments

Comments
 (0)