Skip to content

Keyvaults - Securing secrets parameter by using object #1022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexanderSehr merged 4 commits into from
Feb 21, 2022
Merged

Keyvaults - Securing secrets parameter by using object #1022

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dac3c77
Securing secrets parameter
vgaupset Feb 18, 2022
431ea49
Updated readme from array to object
vgaupset Feb 18, 2022
a98ecd4
Update arm/Microsoft.KeyVault/vaults/deploy.bicep
vgaupset Feb 21, 2022
3b8637d
Changed secrets argument in parameter file
vgaupset Feb 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 19 additions & 17 deletions arm/Microsoft.KeyVault/vaults/.parameters/parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,23 +38,25 @@
]
},
"secrets": {
"value": [
{
"name": "secretName",
"value": "secretValue",
"contentType": "Something",
"attributesExp": 1702648632,
"attributesNbf": 10000,
"roleAssignments": [
{
"roleDefinitionIdOrName": "Reader",
"principalIds": [
"<<deploymentSpId>>"
]
}
]
}
]
"value": {
"secureList": [
{
"name": "secretName",
"value": "secretValue",
"contentType": "Something",
"attributesExp": 1702648632,
"attributesNbf": 10000,
"roleAssignments": [
{
"roleDefinitionIdOrName": "Reader",
"principalIds": [
"<<deploymentSpId>>"
]
}
]
}
]
}
},
"keys": {
"value": [
Expand Down
7 changes: 5 additions & 2 deletions arm/Microsoft.KeyVault/vaults/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ param location string = resourceGroup().location
param accessPolicies array = []

@description('Optional. All secrets to create')
param secrets array = []
@secure()
param secrets object = {}

@description('Optional. All keys to create')
param keys array = []
Expand Down Expand Up @@ -159,6 +160,8 @@ var formattedAccessPolicies = [for accessPolicy in accessPolicies: {
tenantId: contains(accessPolicy, 'tenantId') ? accessPolicy.tenantId : tenant().tenantId
}]

var secretList = !empty(secrets) ? secrets.secureList : []

module pid_cuaId '.bicep/nested_cuaId.bicep' = if (!empty(cuaId)) {
name: 'pid-${cuaId}'
params: {}
Expand Down Expand Up @@ -217,7 +220,7 @@ module keyVault_accessPolicies 'accessPolicies/deploy.bicep' = if (!empty(access
}
}

module keyVault_secrets 'secrets/deploy.bicep' = [for (secret, index) in secrets: {
module keyVault_secrets 'secrets/deploy.bicep' = [for (secret, index) in secretList: {
name: '${uniqueString(deployment().name, location)}-KeyVault-Secret-${index}'
params: {
name: secret.name
Expand Down
2 changes: 1 addition & 1 deletion arm/Microsoft.KeyVault/vaults/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ This module deploys a key vault and its child resources.
| `networkAcls` | object | `{object}` | | Optional. Service endpoint object information. For security reasons, it is recommended to set the DefaultAction Deny |
| `privateEndpoints` | array | `[]` | | Optional. Configuration Details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible |
| `roleAssignments` | array | `[]` | | Optional. Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11' |
| `secrets` | _[secrets](secrets/readme.md)_ array | `[]` | | Optional. All secrets to create |
| `secrets` | _[secrets](secrets/readme.md)_ object | `[]` | | Optional. All secrets to create |
| `softDeleteRetentionInDays` | int | `90` | | Optional. softDelete data retention days. It accepts >=7 and <=90. |
| `tags` | object | `{object}` | | Optional. Resource tags. |
| `vaultSku` | string | `premium` | `[premium, standard]` | Optional. Specifies the SKU for the vault |
Expand Down