Bicep params support for Key Vault secrets

[stephaniezyen]

I can use the "getSecret()" function in Bicep params file to access Key Vault Secrets

[polatengin]

Proposal: Adding az.getSecret() method support in .bicepparam files

I'd like to share the Proposal for the az.getSecret() method in .bicepparam files

Introduction

Currently, accessing a KeyVault and referencing a Secret with a parameter is only possible with Nested ARM Deployments, via modules in bicep files. Example;

// main.bicep
resource kv 'Microsoft.KeyVault/vaults@2019-09-01' existing = {
  name: 'testkeyvault'
}

module secret 'secret.bicep' = {
  name: 'secret'
  params: {
    mySecret: kv.getSecret('mySecret')
  }
}

// secret.bicep
@secure()
param mySecret string

output exposed string = mySecret

There are some missing features;

• it's not possible to reference a Secret from a KeyVault, inside of a .bicepparam file
• if .bicep file doesn't have the KeyVault resource, it's not possible to reference a Secret

Proposed change

Have az.getSecret() function in az namespace and make it available to .bicepparam files

az.getSecret() function gets the following parameters;

• required: subscriptionId "Id of the Subscription that has the target KeyVault"
• required: resourceGroupName "Name of the Resource Group that has the target KeyVault"
• required: keyVaultName "Name of the target KeyVault"
  -required: secretName "Name of the Secret"
• optional: secretVersion "Version of the Secret"

During the compilation time, getSecret() method serialize as a Reference Typed Parameter syntax, so, compiler/builder doesn't have to access to the KeyVault and get the Secret value. But at the deployment time, ARM grabs the Secret value and uses it.

// parameters.bicepparam

using 'main.bicep'

param sqlPwd = az.getSecret('<subscriptionId>', '<resourceGroupName>', '<keyVaultName>', '<secretName>')
param webPwd = az.getSecret('<subscriptionId>', '<resourceGroupName>', '<keyVaultName>', '<secretName>', '<secretVersion>')

Compiled ARM Parameters Json file would look like this;

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "sqlPwd": {
      "reference": {
        "keyVault": {
          "id": "/subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.KeyVault/vaults/<keyVaultName>"
        },
        "secretName": "<secretName>"
      }
    },
    "webPwd": {
      "reference": {
        "keyVault": {
          "id": "/subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.KeyVault/vaults/<keyVaultName>"
        },
        "secretName": "<secretName>",
        "secretVersion": "<secretVersion>"
      }
    }
  }
}

Conclusion

Overall, these changes will enhance the .bicepparam file experience and make the deployments safer by referencing secrets to parameters 👍

[Jarod1662]

I'm at a blocker with a project that I am working on. I've tried a few various methods which either don't work or simply makes the secrets appear in plain text. Is there any confirmation when the support will be available?