Azure / Azure/bicep

listkeys function should not work as output using variable assignment

Open
#9,314 2 comments 0 reactions 0 assignees View on GitHub
story: linter rules
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

### Discussed in https://github.com/Azure/bicep/discussions/9293

Originally posted by **vlahane** December 14, 2022
Using below bicep code (example) able to pass keys as output using variable & deploy, I think we should give some error
as we are not allowing outputing keys like `output accountKeys = '${listKeys(storageAccount.id, '2019-04-01').keys[0].value}'
` which gives expected error: `Outputs should not contain secrets. Found possible secret: function 'listKeys'` but below example works fine.

example:
```

param storgeAccountName string
param location string
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
name: storgeAccountName
location: location
kind: 'StorageV2'
sku: {
name: 'Standard_LRS'
}
properties: {
accessTier: 'Hot'
}
}

var keys = '${listKeys(storageAccount.id, '2019-04-01').keys[0].value}'
output accountKeys string = keys
```
` tl;dr:` If above (example) output keys using variable is not recommanded then ideally bicep should not allow assigning listKeys to variable as well or does listkeys output supported via variable assignment if so then we still exporting secrets using outputs?

`Bicep version : 0.13.1`

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named. Reproduce the minimal Bicep example and compare its variable-based output with the direct listKeys output; done when the intended secret-output validation consistently handles both forms.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
compilers, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.