You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-resource-manager/bicep/file.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ For a step-by-step tutorial that guides you through the process of creating a Bi
16
16
17
17
Bicep is a declarative language, which means the elements can appear in any order. Unlike imperative languages, the order of elements doesn't affect how deployment is processed.
18
18
19
-
A Bicep file has the following elements.
19
+
A Bicep file has the following elements:
20
20
21
21
```bicep
22
22
@<decorator>(<argument>)
@@ -122,7 +122,7 @@ The decorators include:
122
122
123
123
| Decorator | Apply to element | Apply to data type | Argument | Description |
124
124
| --------- | ---- | ----------- | ------- |
125
-
| allowed |[param](./parameters.md#allowed-values)| all | array | Use this decorator to make sure the user provides correct values. This decorator is only permitted on `param` statements. To declare that a property must be one of a set of predefined values in a [`type`](./user-defined-data-types.md) or [`output`](./outputs.md) statement, use [union type syntax](./data-types.md#union-types). You can also use union type syntax in `param` statements.|
125
+
| allowed |[param](./parameters.md#allowed-values)| all | array | Use this decorator to make sure the user provides correct values. This decorator is permitted only on `param` statements. To declare that a property must be one of a set of predefined values in a [`type`](./user-defined-data-types.md) or [`output`](./outputs.md) statement, use [union type syntax](./data-types.md#union-types). You can also use union type syntax in `param` statements.|
126
126
| batchSize |[module](./modules.md#batchsize), [resource](./resource-declaration.md#batchsize)| N/A | integer | Set up instances to deploy sequentially. |
127
127
| description |[func](./user-defined-functions.md#description), [param](./parameters.md#description), [module](./modules.md#description), [output](./outputs.md#description), [resource](./resource-declaration.md#description), [type](./user-defined-data-types.md#description), [var](./variables.md#description)| all | string | Provide descriptions for the elements. Use Markdown-formatted text for the description text. |
128
128
| discriminator |[param](./parameters.md#discriminator), [type](./user-defined-data-types.md#discriminator), [output](./outputs.md#discriminator)| object | string | Use this decorator to ensure that the correct subclass is identified and managed. For more information, see [Custom-tagged union data type](./data-types.md#custom-tagged-union-data-type).|
@@ -132,7 +132,7 @@ The decorators include:
132
132
| metadata |[func](./user-defined-functions.md#metadata), [output](./outputs.md#metadata), [param](./parameters.md#metadata), [type](./user-defined-data-types.md#metadata)| all | object | Custom properties to apply to the elements. Can include a description property that's equivalent to the description decorator. |
133
133
| minLength |[param](./parameters.md#length-constraints), [output](./outputs.md#length-constraints), [type](./user-defined-data-types.md#length-constraints)| array, string | int | The minimum length for string and array elements. The value is inclusive. |
134
134
| minValue |[param](./parameters.md#integer-constraints), [output](./outputs.md#integer-constraints), [type](./user-defined-data-types.md#integer-constraints)| int | int | The minimum value for the integer elements. This value is inclusive. |
135
-
| sealed |[param](./parameters.md#sealed), [type](./user-defined-data-types.md#sealed), [output](./outputs.md#sealed)| object | none | Elevate [BCP089](./diagnostics/bcp089.md) from a warning to an error when a property name of a use-define data type is likely a typo. For more information, see [Elevate error level](./user-defined-data-types.md#elevate-error-level). |
135
+
| sealed |[param](./parameters.md#sealed), [type](./user-defined-data-types.md#sealed), [output](./outputs.md#sealed)| object | none | Elevate [BCP089](./diagnostics/bcp089.md) from a warning to an error when a property name of a user-defined data type is likely a typo. For more information, see [Elevate error level](./user-defined-data-types.md#elevate-error-level). |
136
136
| secure |[param](./parameters.md#secure-parameters), [type](./user-defined-data-types.md#secure-types)| string, object | none | Marks the parameter as secure. The value for a secure parameter isn't saved to the deployment history and isn't logged. For more information, see [Secure strings and objects](data-types.md#secure-strings-and-objects). |
137
137
138
138
## Parameters
@@ -450,13 +450,13 @@ var foo = resourceGroup(
450
450
myRgName)
451
451
```
452
452
453
-
For multiple-line declaration samples, see [Arrays](./data-types.md#arrays) and [Objects](./data-types.md#objects).
453
+
For multiple-line declaration samples, see [arrays](./data-types.md#arrays) and [objects](./data-types.md#objects).
454
454
455
455
## Known limitations
456
456
457
-
* No support for the concept of `apiProfile`, which is used to map a single `apiProfile` to a set `apiVersion` for each resource type.
457
+
* No support is available for the concept of `apiProfile`, which is used to map a single `apiProfile` to a set `apiVersion` for each resource type.
458
458
* User-defined functions aren't supported at the moment. An experimental feature is currently accessible. For more information, see [User-defined functions in Bicep](./user-defined-functions.md).
459
-
* Some Bicep features require a corresponding change to the intermediate language (Azure Resource Manager JSON templates). We announce these features as available after all the required updates are deployed to global Azure. If you use a different environment, such as Azure Stack, there might be a delay in the availability of the feature. The Bicep feature is only available after the intermediate language is also updated in that environment.
459
+
* Some Bicep features require a corresponding change to the intermediate language (Azure Resource Manager JSON templates). We announce these features as available after all the required updates are deployed to global Azure. If you use a different environment, such as Azure Stack, there might be a delay in the availability of the feature. The Bicep feature is available only after the intermediate language is also updated in that environment.
description: Linter rule - secure secrets in parameters
2
+
title: 'Linter rule: Secure secrets in parameters'
3
+
description: This article describes the linter rule, secure secrets in parameters.
4
4
ms.topic: reference
5
5
ms.custom: devx-track-bicep
6
6
ms.date: 03/20/2024
7
7
---
8
8
9
-
# Linter rule - secure secrets in parameters
9
+
# Linter rule: Secure secrets in parameters
10
10
11
-
This rule finds parameters whose names look like secrets but without the [secure decorator](./parameters.md#use-decorators), for example: a parameter name contains the following keywords:
11
+
This rule finds parameters whose names look like secrets but without the [secure decorator](./parameters.md#use-decorators). For example, a parameter name contains the following keywords:
12
12
13
-
- password
14
-
- pwd
15
-
- secret
16
-
- accountkey
17
-
- acctkey
13
+
-`password`
14
+
-`pwd`
15
+
-`secret`
16
+
-`accountkey`
17
+
-`acctkey`
18
18
19
19
## Linter rule code
20
20
21
-
Use the following value in the [Bicep configuration file](bicep-config-linter.md) to customize rule settings:
21
+
To customize rule settings, use the following value in the [Bicep configuration file](bicep-config-linter.md):
22
22
23
23
`secure-secrets-in-params`
24
24
25
25
## Solution
26
26
27
27
Use the [secure decorator](./parameters.md#use-decorators) for the parameters that contain secrets. The secure decorator marks the parameter as secure. The value for a secure parameter isn't saved to the deployment history and isn't logged.
28
28
29
-
The following example fails this test because the parameter name may contain secrets.
29
+
The following example fails this test because the parameter name might contain secrets.
30
30
31
31
```bicep
32
32
param mypassword string
@@ -39,21 +39,21 @@ You can fix it by adding the secure decorator:
39
39
param mypassword string
40
40
```
41
41
42
-
Optionally, you can use **Quick Fix** to add the secure decorator:
42
+
Optionally, you can use **Quick Fix** to add the secure decorator.
43
43
44
-
:::image type="content" source="./media/linter-rule-secure-secrets-in-parameters/linter-rule-secure-secrets-in-parameters-quick-fix.png" alt-text="The screenshot of Secured default value linter rule quick fix.":::
44
+
:::image type="content" source="./media/linter-rule-secure-secrets-in-parameters/linter-rule-secure-secrets-in-parameters-quick-fix.png" alt-text="Screenshot that shows the secured default value for the linter rule Quick Fix.":::
45
45
46
-
## Silencing false positives
46
+
## Silence false positives
47
47
48
-
Sometimes this rule alerts on parameters that don't actually contain secrets. In these cases, you can disable the warning for this line by adding `#disable-next-line secure-secrets-in-params` before the line with the warning. For example:
48
+
Sometimes this rule alerts on parameters that don't contain secrets. In these cases, disable the warning for this line by adding `#disable-next-line secure-secrets-in-params` before the line with the warning. For example:
49
49
50
50
```bicep
51
51
#disable-next-line secure-secrets-in-params // Doesn't contain a secret
52
52
param mypassword string
53
53
```
54
54
55
-
It's good practice to add a comment explaining why the rule doesn't apply to this line.
55
+
It's good practice to add a comment that explains why the rule doesn't apply to this line.
56
56
57
-
## Next steps
57
+
## Related content
58
58
59
59
For more information about the linter, see [Use Bicep linter](./linter.md).
0 commit comments