Use getSecret() to retrieve a secret value from a KeyVault provisioned in the same deployment
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
**Is your feature request related to a problem? Please describe.**
It would be nice if I could compose a KeyVault resource, a secret resource, and use that stored secret value in downstream resources within the same deployment.
Today, I have to deploy a KeyVault and seed the secret I want to retrieve, and only after that can I make another deployment referring to that KeyVault with an `existing` resource declaration to retrieve the secret value with getSecret().
**Describe the solution you'd like**
I'd like to declare a KeyVault resource in a deployment, and use it to getSecret() after its creation with implied dependency.
Let's say I have `storeSecret.bicep`:
```bicep
# storeSecret.bicep
resource keyvault 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'mykv${uniqueString(resourceGroup().id)}'
location: resourceGroup().location
properties: {
accessPolicies: []
enabledForDeployment: true
enabledForTemplateDeployment: true
networkAcls: {
defaultAction: 'Allow'
bypass: 'AzureServices'
}
sku: {
name: 'standard'
family: 'A'
}
tenantId: subscription().tenantId
}
}
var secretName = 'mySecret'
var myValue = 'abc123'
resource mySecret 'Microsoft.KeyVault/vaults/secrets@2019-09-01' = {
name: '${keyvault.name}/${secretName}'
properties: {
value: myValue
}
}
module echoSecret './echoSecret.bicep' = {
name: 'echoSecret'
params: {
secret: keyvault.getSecret(secretName)
}
}
```
and I want to use that in a module referred to in that same deployment, `echoSecret.bicep`:
```bicep
# echoSecret.bicep
@secure()
param secret string
resource echoScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
name: 'echoScript'
location: resourceGroup().location
kind: 'AzureCLI'
properties: {
azCliVersion: '2.25.0'
cleanupPreference: 'OnSuccess'
scriptContent: 'echo ${secret}'
retentionInterval: 'P1D'
timeout: 'PT30M'
}
}
```
However, with this particular arrangement, nothing is ever deployed, explicitly declaring a `dependsOn: [ keyvault, mySecret ]` for the `echoSecret` module doesn't have an effect, and this results in an error:
```json
{
"error": {
"code": "KeyVaultParameterReferenceNotFound",
"message": "The specified KeyVault '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.KeyVault/vaults/mykv{uniqueString}' could not be found. Please see https://aka.ms/arm-keyvault for usage details."
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.