{"id":611,"date":"2021-11-16T02:04:13","date_gmt":"2021-11-16T02:04:13","guid":{"rendered":"https:\/\/thecloudmarathoner.com\/?p=611"},"modified":"2021-11-16T13:55:20","modified_gmt":"2021-11-16T13:55:20","slug":"managing-azure-bicep-sensitive-info-with-key-vault","status":"publish","type":"post","link":"https:\/\/thecloudmarathoner.com\/index.php\/2021\/11\/16\/managing-azure-bicep-sensitive-info-with-key-vault\/","title":{"rendered":"What are the good options to manage sensitive info in Azure Bicep?"},"content":{"rendered":"\n

Hello Cloud Marathoners,<\/p>\n\n\n\n

Every seasoned IT professional knows that sensitive information should not be exposed as a clear text on any code. This is especially true for infrastructure-as-code (aka, IaC) scenarios where passwords and keys are part of the deployment. <\/p>\n\n\n\n

One way to stay compliant in accomplishing this goal is the integration of an Azure Key Vault service into your deployment code. This Azure security service is primarily intended to store sensitive information like password, keys, certificates, connections, etc. <\/p>\n\n\n\n

In this post, we will look into two different ways how we could integrate Azure Key Vault services in our Azure Bicep code.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n


Option – 1: Using getSecret() function <\/h3>\n\n\n\n

Our first option is to delegate this important work to a getSecret()<\/code> function. This option could be used with an existing Azure Key Vault resource that is declared in your Azure Bicep code.<\/p>\n\n\n\n

Let’s look into an example where an existing Azure Key Vault service is referenced to provide administrative password for SQL server deployment. <\/p>\n\n\n\n

\"\"
Deploying Azure SQL instance with Azure Key Vault<\/figcaption><\/figure>\n\n\n\n

This sample Bicep code is using sqldb.bicep file as a module, where parameters; such as sqlServerName <\/code>and adminLogin<\/code> are passed through with a secret name of ExamplePassword<\/code>.<\/p>\n\n\n\n

The ExamplePassword<\/code> secret name should be already set and ready in the referenced Key Vault service above. Here is the view of this secret on Azure portal.<\/p>\n\n\n\n

\"\"
Azure Key Vault with secretes in portal<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Let’s have a quick view into the sqldb.bicep<\/code> file, as it is referenced in the main Bicep file.<\/p>\n\n\n\n

\"\"
sqldb.bicep file<\/figcaption><\/figure>\n\n\n\n

Now, let’s deploy these resources with a secret value from Key Vault resource that has a secret name ExamplePassword<\/code>.

What happened? I am getting an error on my first deployment execution \ud83d\ude41<\/p>\n\n\n\n

\"\"
Error on deploying Bicep code with SQL server provisioning<\/figcaption><\/figure>\n\n\n\n

Upon carefully analyzing error, I see the following reason for this error: <\/p>\n\n\n\n

At least one resource deployment operation failed. Please list deployment operations for details. Please see https:\/\/aka.ms\/DeployOperations for usage details.”,”details”:[{“code”:”RegionDoesNotAllowProvisioning”,”message”:”Location ‘East US 2’ is not accepting creation of new Windows Azure SQL Database servers at this time.<\/p>Azure deployment error<\/cite><\/blockquote>\n\n\n\n

Based on the error message, we change the location to eastus<\/code> and re-run the script. Now, we got the following positive result in console and portal:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"
Deployment results in Azure Portal RG<\/figcaption><\/figure>\n\n\n\n

Next, we will attempt to login into a SQL Server instance.
A successful login will look like the following screen:<\/p>\n\n\n\n

\"\"
Successful login into the SQL instance<\/figcaption><\/figure>\n\n\n\n

Important Note:<\/strong><\/h3>\n\n\n\n

If you are getting an error <\/strong>during the login then try to check the following steps:<\/p>\n\n\n\n