AzureKeyVault Secret deployment error message is empty
- Dominant language
- TypeScript
- Stars
- 108
- Forks
- 44
- Avg merge
- 18h 53m
- Merged PRs (30d)
- 29
Description
**Bicep version**
Bicep CLI version 0.24.24 (5646341b0c)
**Describe the bug**
I am new to bicep templates and I while looking at the documentation I wanted to find the best safe way to store my deployment secrets. In doing so, I found documentation pointing me towards using KeyVault and secrets. I created my keyvault manually (in the portal) paying special attention to assigning roles correctly to both myself and my service principal.
Despite this I was met with a `BadRequest` message for each of the deployment of my secrets.
**To Reproduce**
Here is my bicep module to handle secrets:
```bicep
@secure()
@description('Value of the secret to be stored')
param value string
@secure()
@description('Name of the key for the secret to be stored')
param name string
resource aoaiKeyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
name: 'aoai-tests-keyvault'
}
resource keyVaultSecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
parent: aoaiKeyVault
name: name
properties: {
value: value
}
}
```
Then I would use this module like so:
```bicep
module cognitiveSearchEndpointSecret 'key_vault_store.bicep' = {
name: 'cog-search-endpoint'
params: {
name: 'COGNITIVE_SEARCH_ENDPOINT'
value: 'https://${cognitiveSearch.name}.search.windows.net'
}
}
```
This resulted in the follow error message for the secret deployment
```json
{
"code": "DeploymentFailed",
"target": "/subscriptions/e72e5254-f265-4e95-9bd2-9ee8e7329051/resourceGroups/josealvar-azd-tests-dev/providers/Microsoft.Resources/deployments/gpt-35-turbo-1106-openai-key",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
"details": [
{
"code": "BadRequest",
"message": ""
}
]
}
```
**Additional context**
After too many hours searching, I decided to try adding the secret manually, just to discard that it was an access policy issue. It turns out that the portal provides a very helpful hint for secret names:
I realize that this is a backend issue and not necessarily bicep. I am more than happy to relay this issue to a more appropriate audience if necessary.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the Azure Key Vault secret deployment using the shown key_vault_store.bicep module and inspect the deployment operations for the empty BadRequest detail. The payload names no repository file or test; a useful outcome would be identifying the owning component and defining a change that produces an actionable error message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100