Will layered provisioning support layer specific hooks?

[ronaldbosma]

I've seen layered provisioning being mentioned in azure-dev-cli_1.19.0 and azure-dev-cli_1.21.2, but I didn't find any documentation on it yet.

I’m curious if it will be possible to define hooks between layers. My use case is:

1. Deploy a service principal and Key Vault in the first layer
2. Run a hook to generate a client secret/certificate and store it in Key Vault
3. Deploy a second layer that uses the secret/certificate from Key Vault

Will this be possible?

[vhvb1989]

@weikanglim @wbreza - Do you know?

@ronaldbosma , thanks for starting the conversation about this use-case.

[weikanglim]

@ronaldbosma Thanks for starting the discussion!

Layered provisioning is still pretty early, and it doesn’t yet support layer-specific hooks. Hooks today only run at the broader command level (preprovision, postprovision, etc.).

For the scenario you described—creating a service principal, generating a secret, storing it in Key Vault, and then deploying the next layer—I usually think of that as a small seeding workflow. While azd’s workflow model is still limited today (you can override up, but we don’t yet support fully custom workflows or standalone scripts), if we were to open it up more, I suspect it would give you a cleaner way to separate “set up the environment once” from “provision infra repeatedly.”

You can achieve this with hooks, but you’ll want to keep the script idempotent so it doesn’t recreate secrets on every run. Workflows generally make this kind of setup easier to understand and maintain—especially once the workflow system expands.

And if layer-level hooks would make your scenario easier, I’d really love to hear more about that.

[ronaldbosma]

Hi @weikanglim. I am indeed using hooks at the moment to achieve my use case. This is my current setup:

1. Deploy a service principal, Key Vault and more with Bicep using azd provision
2. In postprovision hooks
   1. Generate a client secret/certificate and store it in Key Vault (is idemptotent)
   2. Deploy Bicep resources that use the secret/certificate from Key Vault

Because both step 1 and step 2.ii deploy Bicep resources, I thought the layered provisioning would be a good match for me if it supports layer specific hooks.

I don't have experience with customizing azd's workflow, so I can't say if that would be a better fit.