Azure / Azure/bicep-types-az

AzureKeyVault Secret deployment error message is empty

Open
#2,011 2 comments 2 reactions 0 assignees View on GitHub
KeyVault Service Attention
Dominant language
TypeScript
Stars
108
Forks
44
Avg merge
18h 53m
Merged PRs (30d)
29

Description

**Bicep version**
Bicep CLI version 0.24.24 (5646341b0c)

**Describe the bug**

I am new to bicep templates and I while looking at the documentation I wanted to find the best safe way to store my deployment secrets. In doing so, I found documentation pointing me towards using KeyVault and secrets. I created my keyvault manually (in the portal) paying special attention to assigning roles correctly to both myself and my service principal.

Despite this I was met with a `BadRequest` message for each of the deployment of my secrets.

**To Reproduce**
Here is my bicep module to handle secrets:

```bicep
@secure()
@description('Value of the secret to be stored')
param value string

@secure()
@description('Name of the key for the secret to be stored')
param name string

resource aoaiKeyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
name: 'aoai-tests-keyvault'
}

resource keyVaultSecret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
parent: aoaiKeyVault
name: name
properties: {
value: value
}
}
```

Then I would use this module like so:

```bicep

module cognitiveSearchEndpointSecret 'key_vault_store.bicep' = {
name: 'cog-search-endpoint'
params: {
name: 'COGNITIVE_SEARCH_ENDPOINT'
value: 'https://${cognitiveSearch.name}.search.windows.net'
}
}
```

This resulted in the follow error message for the secret deployment

```json
{
"code": "DeploymentFailed",
"target": "/subscriptions/e72e5254-f265-4e95-9bd2-9ee8e7329051/resourceGroups/josealvar-azd-tests-dev/providers/Microsoft.Resources/deployments/gpt-35-turbo-1106-openai-key",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
"details": [
{
"code": "BadRequest",
"message": ""
}
]
}
```

**Additional context**
After too many hours searching, I decided to try adding the secret manually, just to discard that it was an access policy issue. It turns out that the portal provides a very helpful hint for secret names:

image

I realize that this is a backend issue and not necessarily bicep. I am more than happy to relay this issue to a more appropriate audience if necessary.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the Azure Key Vault secret deployment using the shown key_vault_store.bicep module and inspect the deployment operations for the empty BadRequest detail. The payload names no repository file or test; a useful outcome would be identifying the owning component and defining a change that produces an actionable error message.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.