Working with bicepparam files

[nad-au]

We've recently switched from Terraform to Bicep and over the last 6 months we've created a Hub & Spoke Landing Zone and all new deployments are using bicep.

Over the last 30 or so projects I've noticed we haven't used bicepparam at all because a lot of projects need to inject param values which are not known inside Azure, such as GitHub secrets or values from a 3rd-party which require some scripting in the pipeline.

We're using json files because they are easier to manipulate, however the code is a bit hacky. For example:

jq -c '.parameters.postgresAdminPassword.value = $val' --arg val '${{ secrets.POSTGRES_ADMIN_PASSWORD }}' mg.spoke.dev.json > tmp.$$.json && mv tmp.$$.json mg.spoke.dev.json

An alternative to this would be to try and update the bicepparam directly, but I'm not great with linux utilities. My suggestion would be to add a CLI feature so that individual params could be updated. For example:

az bicep update-param --file params.bicepparam --name postgresAdminPassword --value '${{ secrets.POSTGRES_ADMIN_PASSWORD }}

Thoughts?

[kevball2]

Take a look and the functions available for bicep parameter files
https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-functions-parameters-file
You can get secrets from key vault and get values in the pipeline from readEnvironmentVariable()