Azure / Azure/bicep

Use getSecret() to retrieve a secret value from a KeyVault provisioned in the same deployment

Open
#4,081 19 comments 1 reaction 1 assignee Claimed by @jeskew View on GitHub
intermediate language
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Is your feature request related to a problem? Please describe.**

It would be nice if I could compose a KeyVault resource, a secret resource, and use that stored secret value in downstream resources within the same deployment.

Today, I have to deploy a KeyVault and seed the secret I want to retrieve, and only after that can I make another deployment referring to that KeyVault with an `existing` resource declaration to retrieve the secret value with getSecret().

**Describe the solution you'd like**

I'd like to declare a KeyVault resource in a deployment, and use it to getSecret() after its creation with implied dependency.

Let's say I have `storeSecret.bicep`:

```bicep
# storeSecret.bicep

resource keyvault 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'mykv${uniqueString(resourceGroup().id)}'
location: resourceGroup().location
properties: {
accessPolicies: []
enabledForDeployment: true
enabledForTemplateDeployment: true
networkAcls: {
defaultAction: 'Allow'
bypass: 'AzureServices'
}
sku: {
name: 'standard'
family: 'A'
}
tenantId: subscription().tenantId
}
}

var secretName = 'mySecret'
var myValue = 'abc123'

resource mySecret 'Microsoft.KeyVault/vaults/secrets@2019-09-01' = {
name: '${keyvault.name}/${secretName}'
properties: {
value: myValue
}
}

module echoSecret './echoSecret.bicep' = {
name: 'echoSecret'
params: {
secret: keyvault.getSecret(secretName)
}
}
```

and I want to use that in a module referred to in that same deployment, `echoSecret.bicep`:

```bicep
# echoSecret.bicep

@secure()
param secret string

resource echoScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
name: 'echoScript'
location: resourceGroup().location
kind: 'AzureCLI'
properties: {
azCliVersion: '2.25.0'
cleanupPreference: 'OnSuccess'
scriptContent: 'echo ${secret}'
retentionInterval: 'P1D'
timeout: 'PT30M'
}
}
```

However, with this particular arrangement, nothing is ever deployed, explicitly declaring a `dependsOn: [ keyvault, mySecret ]` for the `echoSecret` module doesn't have an effect, and this results in an error:

```json
{
"error": {
"code": "KeyVaultParameterReferenceNotFound",
"message": "The specified KeyVault '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.KeyVault/vaults/mykv{uniqueString}' could not be found. Please see https://aka.ms/arm-keyvault for usage details."
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.