Skip to content

Commit 7ed02f7

Browse files
taylorturnertaylorturner
authored
Make this document easier to understand
Having just done this, I struggled for 2 days trying to figure out how the parameters worked. The concept of referencing the Key Vault is very straight forward. It's how everything fits together that is difficult to understand. Especially since the majority of the other documentation calls for using a parameters file. Originally it says you must use **linked** templates which is not true, you can also use nested. And I think understanding nested templates makes linked templates simple. Also, by providing a complete template instead of just a resource block it shows how the key vault parameters are not defined in the top parameters block but they are defined in the resources.deployment.parameters block.
1 parent 5e46ec9 commit 7ed02f7

File tree

1 file changed

+102
-21
lines changed

1 file changed

+102
-21
lines changed

‎articles/azure-resource-manager/managed-applications/key-vault-access.md

Lines changed: 102 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -47,33 +47,114 @@ This article describes how to configure the Key Vault to work with Managed Appli
4747

4848
## Reference Key Vault secret
4949

50-
To pass a secret from a Key Vault to a template in your Managed Application, you must use a [linked template](../templates/linked-templates.md) and reference the Key Vault in the parameters for the linked template. Provide the resource ID of the Key Vault and the name of the secret.
50+
To pass a secret from a Key Vault to a template in your Managed Application, you must use a [linked or nested template](../templates/linked-templates.md) and reference the Key Vault in the parameters for the linked or nested template. Provide the resource ID of the Key Vault and the name of the secret.
5151

5252
```json
53-
"resources": [{
54-
"apiVersion": "2015-01-01",
55-
"name": "linkedTemplate",
56-
"type": "Microsoft.Resources/deployments",
57-
"properties": {
58-
"mode": "incremental",
59-
"templateLink": {
60-
"uri": "https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/keyvaultparameter/sqlserver.json",
61-
"contentVersion": "1.0.0.0"
53+
{
54+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
55+
"contentVersion": "1.0.0.0",
56+
"parameters": {
57+
"location": {
58+
"type": "string",
59+
"defaultValue": "[resourceGroup().location]",
60+
"metadata": {
61+
"description": "The location where the resources will be deployed."
62+
}
6263
},
63-
"parameters": {
64-
"adminPassword": {
65-
"reference": {
66-
"keyVault": {
67-
"id": "/subscriptions/<subscription-id>/resourceGroups/<rg-name>/providers/Microsoft.KeyVault/vaults/<key-vault-name>"
64+
"vaultName": {
65+
"type": "string",
66+
"metadata": {
67+
"description": "The name of the keyvault that contains the secret."
68+
}
69+
},
70+
"secretName": {
71+
"type": "string",
72+
"metadata": {
73+
"description": "The name of the secret."
74+
}
75+
},
76+
"vaultResourceGroupName": {
77+
"type": "string",
78+
"metadata": {
79+
"description": "The name of the resource group that contains the keyvault."
80+
}
81+
},
82+
"vaultSubscription": {
83+
"type": "string",
84+
"defaultValue": "[subscription().subscriptionId]",
85+
"metadata": {
86+
"description": "The name of the subscription that contains the keyvault."
87+
}
88+
}
89+
},
90+
"resources": [
91+
{
92+
"type": "Microsoft.Resources/deployments",
93+
"apiVersion": "2018-05-01",
94+
"name": "dynamicSecret",
95+
"properties": {
96+
"mode": "Incremental",
97+
"expressionEvaluationOptions": {
98+
"scope": "inner"
99+
},
100+
"template": {
101+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
102+
"contentVersion": "1.0.0.0",
103+
"parameters": {
104+
"adminLogin": {
105+
"type": "string"
106+
},
107+
"adminPassword": {
108+
"type": "securestring"
109+
},
110+
"location": {
111+
"type": "string"
112+
}
113+
},
114+
"variables": {
115+
"sqlServerName": "[concat('sql-', uniqueString(resourceGroup().id, 'sql'))]"
116+
},
117+
"resources": [
118+
{
119+
"type": "Microsoft.Sql/servers",
120+
"apiVersion": "2018-06-01-preview",
121+
"name": "[variables('sqlServerName')]",
122+
"location": "[parameters('location')]",
123+
"properties": {
124+
"administratorLogin": "[parameters('adminLogin')]",
125+
"administratorLoginPassword": "[parameters('adminPassword')]"
126+
}
127+
}
128+
],
129+
"outputs": {
130+
"sqlFQDN": {
131+
"type": "string",
132+
"value": "[reference(variables('sqlServerName')).fullyQualifiedDomainName]"
133+
}
134+
}
135+
},
136+
"parameters": {
137+
"location": {
138+
"value": "[parameters('location')]"
139+
},
140+
"adminLogin": {
141+
"value": "ghuser"
68142
},
69-
"secretName": "<secret-name>"
143+
"adminPassword": {
144+
"reference": {
145+
"keyVault": {
146+
"id": "[resourceId(parameters('vaultSubscription'), parameters('vaultResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('vaultName'))]"
147+
},
148+
"secretName": "[parameters('secretName')]"
149+
}
150+
}
70151
}
71-
},
72-
"adminLogin": { "value": "[parameters('adminLogin')]" },
73-
"sqlServerName": {"value": "[parameters('sqlServerName')]"}
152+
}
74153
}
154+
],
155+
"outputs": {
75156
}
76-
}],
157+
}
77158
```
78159

79160
## Next steps
@@ -82,4 +163,4 @@ You've configured your Key Vault to be accessible during deployment of a Managed
82163

83164
* For information about passing a value from a Key Vault as a template parameter, see [Use Azure Key Vault to pass secure parameter value during deployment](../templates/key-vault-parameter.md).
84165
* For managed application examples, see [Sample projects for Azure managed applications](sample-projects.md).
85-
* To learn how to create a UI definition file for a managed application, see [Get started with CreateUiDefinition](create-uidefinition-overview.md).
166+
* To learn how to create a UI definition file for a managed application, see [Get started with CreateUiDefinition](create-uidefinition-overview.md).

0 commit comments

Comments
 (0)