Azure / Azure/bicep-registry-modules
[AVM Question/Feedback]: KeyVault Secrets question
- Dominant language
- Bicep
- Stars
- 736
- Forks
- 564
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 30
Description
### Check for previous/existing GitHub issues
- [x] I have checked for previous/existing GitHub issues
### Description
I am trying to use the key vault AVM to create copies of secrets from one key vault to another key vault. but ran into an issue calling getsecret. When I try to do this I get an error about unable to pass function expressions below. What would be the best way to copy a secret from one vault to another using the AVM? I was able to do this with my own module but was hoping to eliminate that
```bicep
resource deploymentKeyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
name: deploymentKeyVaultName
scope: resourceGroup(deploymentKeyVaultRG)
}
module keyVault 'br/public:avm/res/key-vault/vault:0.13.3' = {
params: {
name: 'kv-newvault-${environment}-${instance}'
location: location
enableRbacAuthorization: true
publicNetworkAccess: publicNetworkAccess
networkAcls: {
bypass: 'AzureServices'
defaultAction: 'Allow'
ipRules: []
virtualNetworkRules: []
}
sku: 'standard'
secrets: [
{
name: 'sql-connection-string'
value: deploymentKeyVault.getSecret('sql-connection-string')
}
]
}
}
```
```
ERROR: Unhandled exception. System.NotImplementedException: Cannot emit unexpected expression of type ResourceFunctionCallExpression
at Bicep.Core.Emit.ExpressionConverter.ConvertExpression(Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitLanguageExpression(Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitExpression(Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.<>c__DisplayClass23_0.b__0()
at Bicep.Core.Emit.PositionTrackingJsonTextWriter.WritePropertyWithPosition(IPositionable keyPosition, String name, Action valueFunc)
at Bicep.Core.Emit.ExpressionEmitter.EmitPropertyInternal(LanguageExpression expressionKey, Action valueFunc, IPositionable location, Boolean skipCopyCheck)
at Bicep.Core.Emit.ExpressionEmitter.EmitProperty(Expression name, Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitProperty(String name, Expression expression)
at Bicep.Core.Emit.ExpressionEmitter.EmitObjectProperties(ObjectExpression object)
```
Contributor guide
Research direction
Reproduce the supplied Bicep snippet using the AVM key-vault module at br/public:avm/res/key-vault/vault:0.13.3 and inspect how the secrets parameter handles deploymentKeyVault.getSecret(). Determine whether the failure belongs to the module or Bicep expression emission; done means documenting a supported copy approach or providing a fix that compiles successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100