【Azure】Application Gateway と Key Vault を連携してSSL証明書を設定する（Azure CLI）

# Configure your resources
appgwName=""
appgwResgp=""
keyvaultResgp=""
vaultName=""
location=""
sslCertName=""  # SSL証明書の Azure Portal での表示名になる

# Azure にログイン
az login
az account set -s "{SUBSCRIPTION_ID}"

#### 1. 初期設定 ####
# One time operation, create Azure key vault and certificate (can done through portal as well)
az keyvault create -n $vaultName -g $keyvaultResgp --enable-soft-delete -l $location

# One time operation, create user-assigned managed identity
az identity create -n appgw-id -g $appgwResgp -l $location
identityID=$(az identity show -n appgw-id -g $appgwResgp -o tsv --query "id")
identityPrincipal=$(az identity show -n appgw-id -g $appgwResgp -o tsv --query "principalId")

# One time operation, assign the identity to Application Gateway
az network application-gateway identity assign \
  --gateway-name $appgwName \
  --resource-group $appgwResgp \
  --identity $identityID

# One time operation, assign the identity GET secret access to Azure Key Vault
az keyvault set-policy \
-n $vaultName \
-g $keyvaultResgp \
--object-id $identityPrincipal \
--secret-permissions get


#### 2. SSL証明書の登録 ####
# For each new certificate, create a cert on keyvault and add unversioned secret id to Application Gateway
az keyvault certificate import  \
--file {ssl sertification file}  \
--password {ssl sertification password} \
--name $sslCertName  \
--vault-name $vaultName

versionedSecretId=$(az keyvault certificate show -n $sslCertName --vault-name $vaultName --query "sid" -o tsv)

unversionedSecretId=$(echo $versionedSecretId | cut -d'/' -f-5) # remove the version from the url

# For each new certificate, Add the certificate to AppGw
az network application-gateway ssl-cert create \
-n $sslCertName \
--gateway-name $appgwName \
--resource-group $appgwResgp \
--key-vault-secret-id $unversionedSecretId # ssl certificate with name "$sslCertName" will be configured on AppGw


#### 参考：証明書確認コマンド ####
az keyvault certificate list --vault-name $vaultName
az network application-gateway ssl-cert list -g $appgwResgp --gateway-name $appgwName