Azure / Azure/arm-ttk

Passing secrets with decorator @secure() shouldn't give an error

Open
#788 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
468
Forks
208
PR merge metrics
No merged PRs in 30d

Description

Bicep has a decorator @secure() that makes an output be able to pass secrets.
The problem is even using it, I still get an error from ARM toolkit.
Here is the official documentation: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/outputs?tabs=azure-powershell#secure-outputs
Here is the line of code I'm using (Bicep):
```
@secure()
output accountKey string = storageAccount.listKeys().keys[0].value
```
Output in JSON:
```
"accountKey": {
"type": "securestring",
"value": "[listKeys('storageAccount', '2025-01-01').keys[0].value]"
}`
```

Here is the error:
```
NestedTemplate [parameters('storageAccountName')] [ Lines 485 - 776 ]
[-] Outputs Must Not Contain Secrets (6 ms)
Output contains secret: accountKey
```
Since the type is securestring, shouldn't the toolkit consider this as not an issue?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the ARM JSON generated from the shown Bicep and the ARM-TTK “Outputs Must Not Contain Secrets” check; trace how securestring outputs are classified. Compare that behavior with the linked Azure secure-outputs documentation, then add a regression case showing that @secure() outputs pass while non-secure secret outputs remain rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.