Azure / Azure/bicep-registry-modules

[AVM Question/Feedback]: KeyVault Secrets question

Open
#6,780 5 comments 0 reactions 0 assignees View on GitHub
Needs: Immediate Attention :bangbang: Needs: Triage :mag: Status: Response Overdue :triangular_flag_on_post: Type: AVM :a: :v: :m: Type: Question/Feedback :raising_hand:
Dominant language
Bicep
Stars
736
Forks
564
Avg merge
3d 15h
Merged PRs (30d)
30

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Description

I am trying to use the key vault AVM to create copies of secrets from one key vault to another key vault. but ran into an issue calling getsecret. When I try to do this I get an error about unable to pass function expressions below. What would be the best way to copy a secret from one vault to another using the AVM? I was able to do this with my own module but was hoping to eliminate that

```bicep
resource deploymentKeyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
name: deploymentKeyVaultName
scope: resourceGroup(deploymentKeyVaultRG)
}

module keyVault 'br/public:avm/res/key-vault/vault:0.13.3' = {
params: {
name: 'kv-newvault-${environment}-${instance}'
location: location
enableRbacAuthorization: true
publicNetworkAccess: publicNetworkAccess
networkAcls: {
bypass: 'AzureServices'
defaultAction: 'Allow'
ipRules: []
virtualNetworkRules: []
}
sku: 'standard'
secrets: [
{
name: 'sql-connection-string'
value: deploymentKeyVault.getSecret('sql-connection-string')
}
]
}
}
```

```
ERROR: Unhandled exception. System.NotImplementedException: Cannot emit unexpected expression of type ResourceFunctionCallExpression
at Bicep.Core.Emit.ExpressionConverter.ConvertExpression(Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitLanguageExpression(Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitExpression(Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.<>c__DisplayClass23_0.b__0()
at Bicep.Core.Emit.PositionTrackingJsonTextWriter.WritePropertyWithPosition(IPositionable keyPosition, String name, Action valueFunc)
at Bicep.Core.Emit.ExpressionEmitter.EmitPropertyInternal(LanguageExpression expressionKey, Action valueFunc, IPositionable location, Boolean skipCopyCheck)
at Bicep.Core.Emit.ExpressionEmitter.EmitProperty(Expression name, Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitProperty(String name, Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitObjectProperties(ObjectExpression object)
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the supplied Bicep snippet using the AVM key-vault module at br/public:avm/res/key-vault/vault:0.13.3 and inspect how the secrets parameter handles deploymentKeyVault.getSecret(). Determine whether the failure belongs to the module or Bicep expression emission; done means documenting a supported copy approach or providing a fix that compiles successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.