listkeys function should not work as output using variable assignment
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
### Discussed in https://github.com/Azure/bicep/discussions/9293
Originally posted by **vlahane** December 14, 2022
Using below bicep code (example) able to pass keys as output using variable & deploy, I think we should give some error
as we are not allowing outputing keys like `output accountKeys = '${listKeys(storageAccount.id, '2019-04-01').keys[0].value}'
` which gives expected error: `Outputs should not contain secrets. Found possible secret: function 'listKeys'` but below example works fine.
example:
```
param storgeAccountName string
param location string
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
name: storgeAccountName
location: location
kind: 'StorageV2'
sku: {
name: 'Standard_LRS'
}
properties: {
accessTier: 'Hot'
}
}
var keys = '${listKeys(storageAccount.id, '2019-04-01').keys[0].value}'
output accountKeys string = keys
```
` tl;dr:` If above (example) output keys using variable is not recommanded then ideally bicep should not allow assigning listKeys to variable as well or does listkeys output supported via variable assignment if so then we still exporting secrets using outputs?
`Bicep version : 0.13.1`
Contributor guide
Research direction
No source files or tests are named. Reproduce the minimal Bicep example and compare its variable-based output with the direct listKeys output; done when the intended secret-output validation consistently handles both forms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- compilers, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100