Passing secrets with decorator @secure() shouldn't give an error
- Dominant language
- PowerShell
- Stars
- 468
- Forks
- 208
- PR merge metrics
- No merged PRs in 30d
Description
Bicep has a decorator @secure() that makes an output be able to pass secrets.
The problem is even using it, I still get an error from ARM toolkit.
Here is the official documentation: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/outputs?tabs=azure-powershell#secure-outputs
Here is the line of code I'm using (Bicep):
```
@secure()
output accountKey string = storageAccount.listKeys().keys[0].value
```
Output in JSON:
```
"accountKey": {
"type": "securestring",
"value": "[listKeys('storageAccount', '2025-01-01').keys[0].value]"
}`
```
Here is the error:
```
NestedTemplate [parameters('storageAccountName')] [ Lines 485 - 776 ]
[-] Outputs Must Not Contain Secrets (6 ms)
Output contains secret: accountKey
```
Since the type is securestring, shouldn't the toolkit consider this as not an issue?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the ARM JSON generated from the shown Bicep and the ARM-TTK “Outputs Must Not Contain Secrets” check; trace how securestring outputs are classified. Compare that behavior with the linked Azure secure-outputs documentation, then add a regression case showing that @secure() outputs pass while non-secure secret outputs remain rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100