edit

Author: mumian

articles/azure-resource-manager/bicep/key-vault-parameter.md

@@ -151,13 +151,13 @@ The following procedure shows how to create a role with the minimum permission,
 
 When using a key vault with the Bicep file for a [Managed Application](../managed-applications/overview.md), you must grant access to the **Appliance Resource Provider** service principal. For more information, see [Access Key Vault secret when deploying Azure Managed Applications](../managed-applications/key-vault-access.md).
 
-## Reference secrets in Bicep file
+## Retrieve secrets in Bicep file
 
-You can use the [getSecret function](./bicep-functions-resource.md#getsecret) in .bicep files to obtain a key vault secret. Note that the `getSecret` function is exclusively applicable to a `Microsoft.KeyVault/vaults` resource. Additionally, it's restricted to usage within the `params` section of a module and can only be used with parameters with the `@secure()` decorator.
+You can use the [getSecret function](./bicep-functions-resource.md#getsecret) in Bicep files to obtain a key vault secret. Note that the `getSecret` function is exclusively applicable to a `Microsoft.KeyVault/vaults` resource. Additionally, it's restricted to usage within the `params` section of a module and can only be used with parameters with the `@secure()` decorator.
 
-Another function called `az.getSecret()` function can be used in .bicepparam files to retrieve key vault secrets. For more information, see [Reference secrets in parameters file](#reference-secrets-in-parameters-file).
+Another function called `az.getSecret()` function can be used in Bicep parameter files to retrieve key vault secrets. For more information, see [Reference secrets in parameters file](#reference-secrets-in-parameters-file).
 
-The following Bicep file creates an Azure SQL server. The `adminPassword` parameter has a `@secure()` decorator.
+Because the `getSecret` function can only be used in the `params` section of a module. Let's create a *sql.bicep* in the same directory as the *main.bicep* file with the following content:
 
 ```bicep
 param sqlServerName string
@@ -167,7 +167,7 @@ param adminLogin string
 @secure()
 param adminPassword string
 
-resource sqlServer 'Microsoft.Sql/servers@2020-11-01-preview' = {
+resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
   name: sqlServerName
   location: location
   properties: {
@@ -178,7 +178,7 @@ resource sqlServer 'Microsoft.Sql/servers@2020-11-01-preview' = {
 }
 ```
 
-Let's use the preceding Bicep file as a module given the file name is *sql.bicep* in the same directory as the main Bicep file.
+Notice in the preceding Bicep file, the `adminPassword` parameter has a `@secure()` decorator. 
 
 The following Bicep file consumes the *sql.bicep* as a module.  The Bicep file references an existing key vault, and calls the `getSecret` function to retrieve the key vault secret, and then passes the value as a parameter to the module.
 
@@ -190,7 +190,7 @@ param subscriptionId string
 param kvResourceGroup string
 param kvName string
 
-resource kv 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
+resource kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
   name: kvName
   scope: resourceGroup(subscriptionId, kvResourceGroup )
 }
@@ -205,9 +205,9 @@ module sql './sql.bicep' = {
 }
 ```
 
-## Reference secrets in parameters file
+## Retrieve secrets in parameters file
 
-If you don't want to use a module, you can reference the key vault in the parameters file. However, the approach varies depending on whether you're using a JSON parameter file or a Bicep parameter file.
+If you don't want to use a module, you can retrieve key vault secrets in parameters file. However, the approach varies depending on whether you're using a JSON parameter file or a Bicep parameter file.
 
 The following Bicep file deploys a SQL server that includes an administrator password. The password parameter is set to a secure string. But the Bicep doesn't specify where that value comes from.
 
@@ -219,7 +219,7 @@ param adminLogin string
 @secure()
 param adminPassword string
 
-resource sqlServer 'Microsoft.Sql/servers@2022-11-01-preview' = {
+resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
   name: sqlServerName
   location: location
   properties: {
@@ -240,7 +240,7 @@ Now, create a parameters file for the preceding Bicep file.
 using './main.bicep'
 
 param sqlServerName = '<your-server-name>'
-param adminLogin = '<your-admin-login'
+param adminLogin = '<your-admin-login>'
 param adminPassword = az.getSecret('<subscription-id>', '<rg-name>', '<key-vault-name>', '<secret-name>', '<secret-version>')
 ```