{"id":58,"date":"2023-03-20T20:28:40","date_gmt":"2023-03-21T04:28:40","guid":{"rendered":"https:\/\/www.dumpsterfirecomputing.com\/?p=58"},"modified":"2023-03-20T20:29:56","modified_gmt":"2023-03-21T04:29:56","slug":"using-azure-key-vault-secrets-in-bicep","status":"publish","type":"post","link":"https:\/\/www.dumpsterfirecomputing.com\/?p=58","title":{"rendered":"Using Azure Key Vault Secrets in Bicep"},"content":{"rendered":"\n

In last week’s learning, I mentioned that I’d figured out how to utilize Azure Key Vault secrets in a bicep deployment. This isn’t exactly earth shattering, but I thought it was fun. The practical applications are numerous. In last week’s case, I was building an IPSec VPN tunnel and wanted to have the pre-shared key available in key vault as I built the VPN tunnel and the rest of the infrastructure.<\/p>\n\n\n\n

Getting there takes a couple steps…<\/p>\n\n\n\n

To start, let me just say that Microsoft does have good documentation<\/a> around this, but I found it took some hands-on to truly understand what I was doing, and how the darn thing was supposed to work.<\/p>\n\n\n\n

For this example, I’m going to provide the bare minimum code necessary to show the process. I’m going to extract a secret from Key Vault and use that secret name to build a virtual network. Ludicrous, right? What we do <\/em>with the secret doesn’t really matter though – it’s how we get that secret and leverage it in code that matters.<\/p>\n\n\n\n

To start, I have a basic key vault named kv-vault01<\/code> with a secret named ‘networkname'<\/code><\/p>\n\n\n\n

\"\"
Example Key Vault<\/figcaption><\/figure>\n\n\n\n

Be sure you’ve allowed ARM deployments to the vault – you’ll find that setting below. Failing to do this will result in your code unable to pull secrets.<\/p>\n\n\n\n

\"\"
Allow Azure Resource Manager for template deployment<\/figcaption><\/figure>\n\n\n\n

That’s all the pre-requisite work. Now we’ll build two bicep files, and I’m going to describe them in reverse order from how they’re called.<\/p>\n\n\n\n

\"\"
vnet.bicep<\/figcaption><\/figure>\n\n\n\n

The role of this file is to build a virtual network using a minimum set of parameters. Line 1 and 2 combine to create the secure parameter<\/em> called name<\/code>, the value of which will ultimately come from the key vault secret. This seems to be the only way to actually use<\/em> a secret from key vault. It must be declared as a secure parameter.<\/p>\n\n\n\n

So how do we get to this file? Think of that as a separate function or module, and we’ll call it from a main bicep file that will be used in the deployment.<\/p>\n\n\n\n

\"\"
main.bicep<\/figcaption><\/figure>\n\n\n\n

In the first block (lines 1 through 3), we’re simply making a reference to an existing key vault named kv-vault01<\/code>.<\/p>\n\n\n\n

On line 5, you can see that instead of using the 'resource' <\/code>identifier, we’re using 'module' <\/code>and calling the name of a bicep file. Lines 7 through 10 you can see the parameters that the 'vnet.bicep'<\/code> module wants, and line 8 is how we get the key vault secret.<\/p>\n\n\n\n

It’s important to state that the getSecret()<\/code> function can really only be used in this context. You can get the secret only when passing that secret as a parameter to a module. So anytime you may want to use a secret, be sure to split out your bicep code so that you’re getting the secret and passing it off to a module.<\/p>\n\n\n\n

If you’re not familiar with how to run the above, it’s actually quite straightforward:<\/p>\n\n\n\n

New-AzResourceGroupDeployment -Name \"deployment-name\" -ResourceGroupName \"rg-tester\" -TemplateFile .\\main.bicep<\/code><\/p>\n\n\n\n

The deployment name (“deployment-name” in my example) can be anything and the resource group name (“rg-tester” in my example) needs to be a pre-existing resource group. If you’re following along, and have the pre-requisites taken care of, you should get a successful deployment:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

In this example the value of the key vault secret was indeed secretnetwork<\/code>, so that worked precisely as expected. It’s not fancy, it’s not flashy, but it works. #BattleFaction<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

In last week’s learning, I mentioned that I’d figured out how to utilize Azure Key Vault secrets in a bicep deployment. This isn’t exactly earth shattering, but I thought it […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,8],"tags":[10,13,11,9,12],"class_list":["post-58","post","type-post","status-publish","format-standard","hentry","category-azure","category-bicep","tag-azure","tag-battlefaction","tag-bicep","tag-key-vault","tag-secrets"],"_links":{"self":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts\/58","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=58"}],"version-history":[{"count":1,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts\/58\/revisions"}],"predecessor-version":[{"id":65,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=\/wp\/v2\/posts\/58\/revisions\/65"}],"wp:attachment":[{"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=58"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=58"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dumpsterfirecomputing.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=58"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}