Skip to content

Commit 6684566

Browse files
laurabrenlaurabren
authored
Merge pull request #201603 from dlepow/mikv
[APIM] Update template for system-assigned managed identity
2 parents 5bc6b89 + a08b49b commit 6684566

File tree

1 file changed

+114
-85
lines changed

1 file changed

+114
-85
lines changed

‎articles/api-management/api-management-howto-use-managed-service-identity.md

Lines changed: 114 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -139,81 +139,95 @@ To configure an access policy using the portal:
139139
### <a name="use-ssl-tls-certificate-from-azure-key-vault"></a>Obtain a custom TLS/SSL certificate for the API Management instance from Azure Key Vault
140140
You can use the system-assigned identity of an API Management instance to retrieve custom TLS/SSL certificates stored in Azure Key Vault. You can then assign these certificates to custom domains in the API Management instance. Keep these considerations in mind:
141141

142-
- The content type of the secret must be *application/x-pkcs12*.
142+
- The content type of the secret must be *application/x-pkcs12*. Learn more about custom domain [certificate requirements](configure-custom-domain.md?tabs=key-vault#domain-certificate-options).
143143
- Use the Key Vault certificate secret endpoint, which contains the secret.
144144

145145
> [!Important]
146146
> If you don't provide the object version of the certificate, API Management will automatically obtain the newer version of the certificate within four hours after it's updated in Key Vault.
147147
148-
The following example shows an Azure Resource Manager template that contains the following steps:
148+
The following example shows an Azure Resource Manager template that uses the system-assigned managed identity of an API Management service instance to retrieve a custom domain certificate from Key Vault.
149+
150+
#### Prerequisites
151+
152+
* An API Management service instance configured with a system-assigned managed identity. To create the instance, you can use an [Azure Quickstart Template](https://azure.microsoft.com/resources/templates/api-management-create-with-msi/).
153+
* An Azure Key Vault instance in the same resource group, hosting a certificate that will be used as a custom domain certificate in API Management.
154+
155+
The following template contains the following steps.
156+
157+
1. Update the access policies of the Azure Key Vault instance and allow the API Management instance to obtain secrets from it.
158+
1. Update the API Management instance by setting a custom domain name through the certificate from the Key Vault instance.
149159

150-
1. Create an API Management instance with a managed identity.
151-
2. Update the access policies of an Azure Key Vault instance and allow the API Management instance to obtain secrets from it.
152-
3. Update the API Management instance by setting a custom domain name through a certificate from the Key Vault instance.
160+
When you run the template, provide parameter values appropriate for your environment.
153161

154162
```json
155163
{
156-
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
157-
"contentVersion": "1.0.0.0",
158-
"parameters": {
159-
"publisherEmail": {
160-
"type": "string",
161-
"minLength": 1,
162-
"metadata": {
163-
"description": "The email address of the owner of the service"
164-
}
165-
},
166-
"publisherName": {
164+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
165+
"contentVersion": "1.0.0.0",
166+
"parameters": {
167+
"apiManagementServiceName": {
167168
"type": "string",
168-
"defaultValue": "Contoso",
169-
"minLength": 1,
170-
"metadata": {
171-
"description": "The name of the owner of the service"
172-
}
173-
},
174-
"sku": {
175-
"type": "string",
176-
"allowedValues": ["Developer",
177-
"Standard",
178-
"Premium"],
179-
"defaultValue": "Developer",
180-
"metadata": {
181-
"description": "The pricing tier of this API Management instance"
182-
}
183-
},
184-
"skuCount": {
185-
"type": "int",
186-
"defaultValue": 1,
187-
"metadata": {
188-
"description": "The instance size of this API Management instance."
169+
"minLength": 8,
170+
"metadata":{
171+
"description": "The name of the API Management service"
189172
}
190173
},
174+
"publisherEmail": {
175+
"type": "string",
176+
"minLength": 1,
177+
"metadata": {
178+
"description": "The email address of the owner of the service"
179+
}
180+
},
181+
"publisherName": {
182+
"type": "string",
183+
"minLength": 1,
184+
"metadata": {
185+
"description": "The name of the owner of the service"
186+
}
187+
},
188+
"sku": {
189+
"type": "string",
190+
"allowedValues": ["Developer",
191+
"Standard",
192+
"Premium"],
193+
"defaultValue": "Developer",
194+
"metadata": {
195+
"description": "The pricing tier of this API Management service"
196+
}
197+
},
198+
"skuCount": {
199+
"type": "int",
200+
"defaultValue": 1,
201+
"metadata": {
202+
"description": "The instance size of this API Management service."
203+
}
204+
},
191205
"keyVaultName": {
192206
"type": "string",
193207
"metadata": {
194-
"description": "Name of the vault"
195-
}
196-
},
197-
"proxyCustomHostname1": {
198-
"type": "string",
199-
"metadata": {
200-
"description": "Gateway custom hostname."
208+
"description": "Name of the key vault"
201209
}
202210
},
203-
"keyVaultIdToCertificate": {
204-
"type": "string",
205-
"metadata": {
206-
"description": "Reference to the Key Vault certificate. https://contoso.vault.azure.net/secrets/contosogatewaycertificate."
207-
}
208-
}
209-
},
210-
"variables": {
211-
"apiManagementServiceName": "[concat('apiservice', uniqueString(resourceGroup().id))]",
212-
"apimServiceIdentityResourceId": "[concat(resourceId('Microsoft.ApiManagement/service', variables('apiManagementServiceName')),'/providers/Microsoft.ManagedIdentity/Identities/default')]"
213-
},
214-
"resources": [{
211+
"proxyCustomHostname1": {
212+
"type": "string",
213+
"metadata": {
214+
"description": "Gateway custom hostname 1. Example: api.contoso.com"
215+
}
216+
},
217+
"keyVaultIdToCertificate": {
218+
"type": "string",
219+
"metadata": {
220+
"description": "Reference to the key vault certificate. Example: https://contoso.vault.azure.net/secrets/contosogatewaycertificate"
221+
}
222+
}
223+
},
224+
"variables": {
225+
"apimServiceIdentityResourceId": "[concat(resourceId('Microsoft.ApiManagement/service', parameters('apiManagementServiceName')),'/providers/Microsoft.ManagedIdentity/Identities/default')]"
226+
},
227+
"resources": [
228+
{
215229
"apiVersion": "2021-08-01",
216-
"name": "[variables('apiManagementServiceName')]",
230+
"name": "[parameters('apiManagementServiceName')]",
217231
"type": "Microsoft.ApiManagement/service",
218232
"location": "[resourceGroup().location]",
219233
"tags": {
@@ -233,43 +247,58 @@ The following example shows an Azure Resource Manager template that contains the
233247
{
234248
"type": "Microsoft.KeyVault/vaults/accessPolicies",
235249
"name": "[concat(parameters('keyVaultName'), '/add')]",
236-
"apiVersion": "2015-06-01",
237-
"dependsOn": [
238-
"[resourceId('Microsoft.ApiManagement/service', variables('apiManagementServiceName'))]"
239-
],
250+
"apiVersion": "2018-02-14",
240251
"properties": {
241252
"accessPolicies": [{
242-
"tenantId": "[reference(variables('apimServiceIdentityResourceId'), '2015-08-31-PREVIEW').tenantId]",
243-
"objectId": "[reference(variables('apimServiceIdentityResourceId'), '2015-08-31-PREVIEW').principalId]",
253+
"tenantId": "[reference(variables('apimServiceIdentityResourceId'), '2018-11-30').tenantId]",
254+
"objectId": "[reference(variables('apimServiceIdentityResourceId'), '2018-11-30').principalId]",
244255
"permissions": {
245256
"secrets": ["get", "list"]
246257
}
247258
}]
248259
}
249260
},
250-
{
251-
"apiVersion": "2017-05-10",
261+
{
262+
"apiVersion": "2021-04-01",
263+
"type": "Microsoft.Resources/deployments",
252264
"name": "apimWithKeyVault",
253-
"type": "Microsoft.Resources/deployments",
254-
"dependsOn": [
255-
"[resourceId('Microsoft.ApiManagement/service', variables('apiManagementServiceName'))]"
265+
"dependsOn": [
266+
"[resourceId('Microsoft.ApiManagement/service', parameters('apiManagementServiceName'))]"
256267
],
257268
"properties": {
258269
"mode": "incremental",
259-
"templateLink": {
260-
"uri": "https://raw.githubusercontent.com/solankisamir/arm-templates/master/basicapim.keyvault.json",
261-
"contentVersion": "1.0.0.0"
262-
},
263-
"parameters": {
264-
"publisherEmail": { "value": "[parameters('publisherEmail')]"},
265-
"publisherName": { "value": "[parameters('publisherName')]"},
266-
"sku": { "value": "[parameters('sku')]"},
267-
"skuCount": { "value": "[parameters('skuCount')]"},
268-
"proxyCustomHostname1": {"value" : "[parameters('proxyCustomHostname1')]"},
269-
"keyVaultIdToCertificate": {"value" : "[parameters('keyVaultIdToCertificate')]"}
270-
}
271-
}
272-
}]
270+
"template": {
271+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
272+
"contentVersion": "1.0.0.0",
273+
"parameters": {},
274+
"resources": [{
275+
"apiVersion": "2021-08-01",
276+
"name": "[parameters('apiManagementServiceName')]",
277+
"type": "Microsoft.ApiManagement/service",
278+
"location": "[resourceGroup().location]",
279+
"tags": {
280+
},
281+
"sku": {
282+
"name": "[parameters('sku')]",
283+
"capacity": "[parameters('skuCount')]"
284+
},
285+
"properties": {
286+
"publisherEmail": "[parameters('publisherEmail')]",
287+
"publisherName": "[parameters('publisherName')]",
288+
"hostnameConfigurations": [{
289+
"type": "Proxy",
290+
"hostName": "[parameters('proxyCustomHostname1')]",
291+
"keyVaultId": "[parameters('keyVaultIdToCertificate')]"
292+
}]
293+
},
294+
"identity": {
295+
"type": "systemAssigned"
296+
}
297+
}]
298+
}
299+
}
300+
}
301+
]
273302
}
274303
```
275304

@@ -292,7 +321,7 @@ API Management is a trusted Microsoft service to the following resources. This a
292321
|Azure Key Vault | [Trusted-access-to-azure-key-vault](../key-vault/general/overview-vnet-service-endpoints.md#trusted-services)|
293322
|Azure Storage | [Trusted-access-to-azure-storage](../storage/common/storage-network-security.md?tabs=azure-portal#trusted-access-based-on-system-assigned-managed-identity)|
294323
|Azure Service Bus | [Trusted-access-to-azure-service-bus](../service-bus-messaging/service-bus-ip-filtering.md#trusted-microsoft-services)|
295-
|Azure Event Hub | [Trused-access-to-azure-event-hub](../event-hubs/event-hubs-ip-filtering.md#trusted-microsoft-services)|
324+
|Azure Event Hubs | [Trused-access-to-azure-event-hub](../event-hubs/event-hubs-ip-filtering.md#trusted-microsoft-services)|
296325

297326
## Create a user-assigned managed identity
298327

@@ -432,13 +461,13 @@ Keep these considerations in mind:
432461
433462
For the complete template, see [API Management with Key Vault based SSL using User Assigned Identity](https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.apimanagement/api-management-key-vault-create/azuredeploy.json).
434463

435-
In this template, you will deploy:
464+
In this template, you'll deploy:
436465

437466
* Azure API Management instance
438467
* Azure user-assigned managed identity
439468
* Azure Key Vault for storing the SSL/TLS certificate
440469

441-
To run the deployment automatically, click the following button:
470+
To run the deployment automatically, select the following button:
442471

443472
[![Deploy to Azure](../media/template-deployments/deploy-to-azure.svg)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.apimanagement%2Fapi-management-key-vault-create%2Fazuredeploy.json)
444473

0 commit comments

Comments
 (0)