你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

KeyVaultAccessControlClient class

包:: @azure/keyvault-admin

KeyVaultAccessControlClient 提供用于管理任何给定 Azure Key Vault 实例中的访问控制和角色分配的方法。客户端支持创建、检索和删除角色。

构造函数

KeyVaultAccessControlClient(string, TokenCredential, AccessControlClientOptions)

创建 KeyVaultAccessControlClient 的实例。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

属性

vaultUrl

保管库的基 URL

方法

createRoleAssignment(string, string, string, string, CreateRoleAssignmentOptions)	在 Azure Key Vault 中创建角色分配。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); const { value: roleDefinition } = await client.listRoleDefinitions("/").next(); const principalId = "4871f6a6-374f-4b6b-8b0c-f5d84db823f6"; const result = await client.createRoleAssignment( "/", "295c179b-9ad3-4117-99cd-b1aa66cf4517", roleDefinition.id, principalId, ); 创建新的角色分配。
deleteRoleAssignment(string, string, DeleteRoleAssignmentOptions)	删除以前在 Azure Key Vault 中创建的角色分配。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); const { value: roleDefinition } = await client.listRoleDefinitions("/").next(); const principalId = "4871f6a6-374f-4b6b-8b0c-f5d84db823f6"; const roleAssignment = await client.createRoleAssignment( "/", "295c179b-9ad3-4117-99cd-b1aa66cf4517", roleDefinition.id, principalId, ); await client.deleteRoleAssignment(roleAssignment.properties.scope, roleAssignment.name); 删除现有角色分配。
deleteRoleDefinition(string, string, DeleteRoleDefinitionOptions)	删除以前在 Azure Key Vault 中创建的自定义角色定义。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient, KnownKeyVaultDataAction, KnownKeyVaultRoleScope, } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); const permissions = [{ dataActions: [KnownKeyVaultDataAction.BackupHsmKeys] }]; const roleDefinitionName = "23b8bb1a-39c0-4c89-a85b-dd3c99273a8a"; const roleDefinition = await client.setRoleDefinition(KnownKeyVaultRoleScope.Global, { permissions, roleDefinitionName, }); await client.deleteRoleDefinition("/", roleDefinition.name);
getRoleAssignment(string, string, GetRoleAssignmentOptions)	获取以前在 Azure Key Vault 中创建的角色分配。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); const { value: roleDefinition } = await client.listRoleDefinitions("/").next(); const principalId = "4871f6a6-374f-4b6b-8b0c-f5d84db823f6"; let roleAssignment = await client.createRoleAssignment( "/", "295c179b-9ad3-4117-99cd-b1aa66cf4517", roleDefinition.id, principalId, ); roleAssignment = await client.getRoleAssignment( roleAssignment.properties.scope, roleAssignment.name, ); console.log(roleAssignment); 获取现有角色分配。
getRoleDefinition(string, string, GetRoleDefinitionOptions)	从 Azure Key Vault 获取角色定义。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); const roleDefinition = await client.getRoleDefinition("/", "b86a8fe4-44ce-4948-aee5-eccb2c155cd7"); console.log(roleDefinition);
listRoleAssignments(string, ListRoleAssignmentsOptions)	循环访问 Azure Key Vault 中的所有可用角色分配。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); for await (const roleAssignment of client.listRoleAssignments("/")) { console.log("Role assignment: ", roleAssignment); } 列出给定范围内的所有角色分配。
listRoleDefinitions(string, ListRoleDefinitionsOptions)	循环访问 Azure Key Vault 中的所有可用角色定义。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); for await (const roleDefinitions of client.listRoleDefinitions("/")) { console.log("Role definition: ", roleDefinitions); } 列出给定范围中的所有角色定义。
setRoleDefinition(string, SetRoleDefinitionOptions)	在 Azure Key Vault 中创建或更新角色定义。示例用法： import { DefaultAzureCredential } from "@azure/identity"; import { KeyVaultAccessControlClient, KnownKeyVaultDataAction, KnownKeyVaultRoleScope, } from "@azure/keyvault-admin"; const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`; const credentials = new DefaultAzureCredential(); const client = new KeyVaultAccessControlClient(vaultUrl, credentials); const permissions = [{ dataActions: [KnownKeyVaultDataAction.BackupHsmKeys] }]; const roleDefinitionName = "23b8bb1a-39c0-4c89-a85b-dd3c99273a8a"; const roleDefinition = await client.setRoleDefinition(KnownKeyVaultRoleScope.Global, { permissions, roleDefinitionName, }); console.log(roleDefinition);

构造函数详细信息

KeyVaultAccessControlClient(string, TokenCredential, AccessControlClientOptions)

创建 KeyVaultAccessControlClient 的实例。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

new KeyVaultAccessControlClient(vaultUrl: string, credential: TokenCredential, options?: AccessControlClientOptions)

参数

vaultUrl: string

Key Vault 的 URL。它应具有此形状：https://${your-key-vault-name}.vault.azure.net。应验证此 URL 是否引用有效的 Key Vault 或托管 HSM 资源。有关详细信息，请参阅 https://aka.ms/azsdk/blog/vault-uri。

credential: TokenCredential

实现用于对服务的请求进行身份验证的 TokenCredential 接口的对象。使用 @azure/identity 包创建符合需求的凭据。

options: AccessControlClientOptions

用于配置 Key Vault API 请求的选项。省略此参数以使用默认配置。

属性详细信息

vaultUrl

保管库的基 URL

vaultUrl: string

属性值

string

方法详细信息

createRoleAssignment(string, string, string, string, CreateRoleAssignmentOptions)

在 Azure Key Vault 中创建角色分配。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

const { value: roleDefinition } = await client.listRoleDefinitions("/").next();

const principalId = "4871f6a6-374f-4b6b-8b0c-f5d84db823f6";
const result = await client.createRoleAssignment(
  "/",
  "295c179b-9ad3-4117-99cd-b1aa66cf4517",
  roleDefinition.id,
  principalId,
);

创建新的角色分配。

function createRoleAssignment(roleScope: string, name: string, roleDefinitionId: string, principalId: string, options?: CreateRoleAssignmentOptions): Promise<KeyVaultRoleAssignment>

参数

roleScope: string

角色分配的范围。

name: string

角色分配的名称。必须是 UUID。

roleDefinitionId: string

角色分配中使用的角色定义 ID。

principalId: string

分配给角色的主体 ID。这会映射到 Active Directory 中的 ID。它可以指向用户、服务主体或安全组。

options: CreateRoleAssignmentOptions

可选参数。

Promise<KeyVaultRoleAssignment>

deleteRoleAssignment(string, string, DeleteRoleAssignmentOptions)

删除以前在 Azure Key Vault 中创建的角色分配。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

const { value: roleDefinition } = await client.listRoleDefinitions("/").next();
const principalId = "4871f6a6-374f-4b6b-8b0c-f5d84db823f6";

const roleAssignment = await client.createRoleAssignment(
  "/",
  "295c179b-9ad3-4117-99cd-b1aa66cf4517",
  roleDefinition.id,
  principalId,
);

await client.deleteRoleAssignment(roleAssignment.properties.scope, roleAssignment.name);

删除现有角色分配。

function deleteRoleAssignment(roleScope: string, name: string, options?: DeleteRoleAssignmentOptions): Promise<void>

参数

roleScope: string

角色分配的范围。

name: string

角色分配的名称。

options: DeleteRoleAssignmentOptions

可选参数。

Promise<void>

deleteRoleDefinition(string, string, DeleteRoleDefinitionOptions)

删除以前在 Azure Key Vault 中创建的自定义角色定义。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import {
  KeyVaultAccessControlClient,
  KnownKeyVaultDataAction,
  KnownKeyVaultRoleScope,
} from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

const permissions = [{ dataActions: [KnownKeyVaultDataAction.BackupHsmKeys] }];
const roleDefinitionName = "23b8bb1a-39c0-4c89-a85b-dd3c99273a8a";
const roleDefinition = await client.setRoleDefinition(KnownKeyVaultRoleScope.Global, {
  permissions,
  roleDefinitionName,
});

await client.deleteRoleDefinition("/", roleDefinition.name);

function deleteRoleDefinition(roleScope: string, name: string, options?: DeleteRoleDefinitionOptions): Promise<void>

参数

roleScope: string

角色定义的范围。

name: string

要删除的角色定义的名称。

options: DeleteRoleDefinitionOptions

可选参数。

Promise<void>

getRoleAssignment(string, string, GetRoleAssignmentOptions)

获取以前在 Azure Key Vault 中创建的角色分配。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

const { value: roleDefinition } = await client.listRoleDefinitions("/").next();
const principalId = "4871f6a6-374f-4b6b-8b0c-f5d84db823f6";

let roleAssignment = await client.createRoleAssignment(
  "/",
  "295c179b-9ad3-4117-99cd-b1aa66cf4517",
  roleDefinition.id,
  principalId,
);

roleAssignment = await client.getRoleAssignment(
  roleAssignment.properties.scope,
  roleAssignment.name,
);
console.log(roleAssignment);

获取现有角色分配。

function getRoleAssignment(roleScope: string, name: string, options?: GetRoleAssignmentOptions): Promise<KeyVaultRoleAssignment>

参数

roleScope: string

角色分配的范围。

name: string

角色分配的名称。

options: GetRoleAssignmentOptions

可选参数。

Promise<KeyVaultRoleAssignment>

getRoleDefinition(string, string, GetRoleDefinitionOptions)

从 Azure Key Vault 获取角色定义。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

const roleDefinition = await client.getRoleDefinition("/", "b86a8fe4-44ce-4948-aee5-eccb2c155cd7");
console.log(roleDefinition);

function getRoleDefinition(roleScope: string, name: string, options?: GetRoleDefinitionOptions): Promise<KeyVaultRoleDefinition>

参数

roleScope: string

角色定义的范围。

name: string

角色定义的名称。

options: GetRoleDefinitionOptions

可选参数。

Promise<KeyVaultRoleDefinition>

listRoleAssignments(string, ListRoleAssignmentsOptions)

循环访问 Azure Key Vault 中的所有可用角色分配。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

for await (const roleAssignment of client.listRoleAssignments("/")) {
  console.log("Role assignment: ", roleAssignment);
}

列出给定范围内的所有角色分配。

function listRoleAssignments(roleScope: string, options?: ListRoleAssignmentsOptions): PagedAsyncIterableIterator<KeyVaultRoleAssignment, KeyVaultRoleAssignment[], PageSettings>

参数

roleScope: string

角色分配的范围。

options: ListRoleAssignmentsOptions

可选参数。

PagedAsyncIterableIterator<KeyVaultRoleAssignment, KeyVaultRoleAssignment[], PageSettings>

listRoleDefinitions(string, ListRoleDefinitionsOptions)

循环访问 Azure Key Vault 中的所有可用角色定义。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyVaultAccessControlClient } from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

for await (const roleDefinitions of client.listRoleDefinitions("/")) {
  console.log("Role definition: ", roleDefinitions);
}

列出给定范围中的所有角色定义。

function listRoleDefinitions(roleScope: string, options?: ListRoleDefinitionsOptions): PagedAsyncIterableIterator<KeyVaultRoleDefinition, KeyVaultRoleDefinition[], PageSettings>

参数

roleScope: string

角色定义的范围。

options: ListRoleDefinitionsOptions

可选参数。

PagedAsyncIterableIterator<KeyVaultRoleDefinition, KeyVaultRoleDefinition[], PageSettings>

setRoleDefinition(string, SetRoleDefinitionOptions)

在 Azure Key Vault 中创建或更新角色定义。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import {
  KeyVaultAccessControlClient,
  KnownKeyVaultDataAction,
  KnownKeyVaultRoleScope,
} from "@azure/keyvault-admin";

const vaultUrl = `https://<MY KEY VAULT HERE>.vault.azure.net`;
const credentials = new DefaultAzureCredential();
const client = new KeyVaultAccessControlClient(vaultUrl, credentials);

const permissions = [{ dataActions: [KnownKeyVaultDataAction.BackupHsmKeys] }];
const roleDefinitionName = "23b8bb1a-39c0-4c89-a85b-dd3c99273a8a";
const roleDefinition = await client.setRoleDefinition(KnownKeyVaultRoleScope.Global, {
  permissions,
  roleDefinitionName,
});
console.log(roleDefinition);

function setRoleDefinition(roleScope: string, options?: SetRoleDefinitionOptions): Promise<KeyVaultRoleDefinition>

参数

roleScope: string

角色定义的范围。

options: SetRoleDefinitionOptions

可选参数。

Promise<KeyVaultRoleDefinition>

通过

构造函数

属性

方法

KeyVaultAccessControlClient(string, TokenCredential, AccessControlClientOptions)

参数

vaultUrl

属性值

createRoleAssignment(string, string, string, string, CreateRoleAssignmentOptions)

参数

返回

deleteRoleAssignment(string, string, DeleteRoleAssignmentOptions)

参数

返回

deleteRoleDefinition(string, string, DeleteRoleDefinitionOptions)

参数

返回

getRoleAssignment(string, string, GetRoleAssignmentOptions)

参数

返回

getRoleDefinition(string, string, GetRoleDefinitionOptions)

参数

返回

listRoleAssignments(string, ListRoleAssignmentsOptions)

参数

返回

listRoleDefinitions(string, ListRoleDefinitionsOptions)

参数

返回

setRoleDefinition(string, SetRoleDefinitionOptions)

参数

返回