Skip to content

Commit b92d959

Browse files
LJSpillerLJSpiller
authored
Merge pull request #194561 from schaffererin/0408-keyvault-secret-quickstart
Creating new Bicep quickstart - Key Vault secret
2 parents 3989200 + ced49a8 commit b92d959

File tree

3 files changed

+138
-0
lines changed

3 files changed

+138
-0
lines changed

‎articles/azure-resource-manager/bicep/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@
8989
items:
9090
- name: Attestation
9191
href: ../../attestation/quickstart-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
92+
- name: Key Vault - secret
93+
href: ../../key-vault/secrets/quick-create-bicep.md?toc=/azure/azure-resource-manager/bicep/toc.json
9294
- name: Storage
9395
items:
9496
- name: Data Share

‎articles/key-vault/secrets/quick-create-bicep.md

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
title: Azure Quickstart - Create an Azure key vault and a secret using Bicep | Microsoft Docs
3+
description: Quickstart showing how to create Azure key vaults, and add secrets to the vaults using Bicep.
4+
services: key-vault
5+
author: schaffererin
6+
tags: azure-resource-manager
7+
ms.service: key-vault
8+
ms.subservice: secrets
9+
ms.topic: quickstart
10+
ms.custom: mvc, subject-armqs, devx-track-azurepowershell, mode-arm
11+
ms.date: 04/08/2022
12+
ms.author: v-eschaffer
13+
#Customer intent: As a security admin who is new to Azure, I want to use Key Vault to securely store keys and passwords in Azure.
14+
---
15+
16+
# Quickstart: Set and retrieve a secret from Azure Key Vault using Bicep
17+
18+
[Azure Key Vault](../general/overview.md) is a cloud service that provides a secure store for secrets, such as keys, passwords, certificates, and other secrets. This quickstart focuses on the process of deploying a Bicep file to create a key vault and a secret.
19+
20+
[!INCLUDE [About Bicep](../../../includes/resource-manager-quickstart-bicep-introduction.md)]
21+
22+
## Prerequisites
23+
24+
* If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
25+
26+
* Your Azure AD user object ID is needed by the template to configure permissions. The following procedure gets the object ID (GUID).
27+
28+
1. Run the following Azure PowerShell or Azure CLI command by select **Try it**, and then paste the script into the shell pane. To paste the script, right-click the shell, and then select **Paste**.
29+
30+
# [CLI](#tab/CLI)
31+
```azurecli-interactive
32+
echo "Enter your email address that is used to sign in to Azure:" &&
33+
read upn &&
34+
az ad user show --id $upn --query "objectId" &&
35+
echo "Press [ENTER] to continue ..."
36+
```
37+
38+
# [PowerShell](#tab/PowerShell)
39+
```azurepowershell-interactive
40+
$upn = Read-Host -Prompt "Enter your email address used to sign in to Azure"
41+
(Get-AzADUser -UserPrincipalName $upn).Id
42+
Write-Host "Press [ENTER] to continue..."
43+
```
44+
45+
---
46+
47+
2. Write down the object ID. You need it in the next section of this quickstart.
48+
49+
## Review the Bicep file
50+
51+
The template used in this quickstart is from [Azure Quickstart Templates](https://azure.microsoft.com/resources/templates/key-vault-create/).
52+
53+
:::code language="bicep" source="~/quickstart-templates/quickstarts/microsoft.keyvault/key-vault-create/main.bicep":::
54+
55+
Two Azure resources are defined in the Bicep file:
56+
57+
* [**Microsoft.KeyVault/vaults**](/azure/templates/microsoft.keyvault/vaults): create an Azure key vault.
58+
* [**Microsoft.KeyVault/vaults/secrets**](/azure/templates/microsoft.keyvault/vaults/secrets): create a key vault secret.
59+
60+
## Deploy the Bicep file
61+
62+
1. Save the Bicep file as **main.bicep** to your local computer.
63+
1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.
64+
65+
# [CLI](#tab/CLI)
66+
67+
```azurecli
68+
az group create --name exampleRG --location eastus
69+
az deployment group create --resource-group exampleRG --template-file main.bicep --parameters keyVaultName=<vault-name> objectID=<object-id>
70+
```
71+
72+
# [PowerShell](#tab/PowerShell)
73+
74+
```azurepowershell
75+
New-AzResourceGroup -Name exampleRG -Location eastus
76+
New-AzResourceGroupDeployment -ResourceGroupName exampleRG -TemplateFile ./main.bicep -keyVaultName "<vault-name>" -objectID "<object-id>"
77+
```
78+
79+
---
80+
81+
> [!NOTE]
82+
> Replace **\<vault-name\>** with the name of the key vault. Replace **\<object-id\>** with the object ID of a user, service principal, or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets.
83+
84+
When the deployment finishes, you should see a message indicating the deployment succeeded.
85+
86+
## Review deployed resources
87+
88+
You can either use the Azure portal to check the key vault and the secret, or use the following Azure CLI or Azure PowerShell script to list the secret created.
89+
90+
# [CLI](#tab/CLI)
91+
92+
```azurecli-interactive
93+
echo "Enter your key vault name:" &&
94+
read keyVaultName &&
95+
az keyvault secret list --vault-name $keyVaultName &&
96+
echo "Press [ENTER] to continue ..."
97+
```
98+
99+
# [PowerShell](#tab/PowerShell)
100+
101+
```azurepowershell-interactive
102+
$keyVaultName = Read-Host -Prompt "Enter your key vault name"
103+
Get-AzKeyVaultSecret -vaultName $keyVaultName
104+
Write-Host "Press [ENTER] to continue..."
105+
```
106+
107+
---
108+
109+
## Clean up resources
110+
111+
When no longer needed, use the Azure portal, Azure CLI, or Azure PowerShell to delete the resource group and its resources.
112+
113+
# [CLI](#tab/CLI)
114+
115+
```azurecli-interactive
116+
az group delete --name exampleRG
117+
```
118+
119+
# [PowerShell](#tab/PowerShell)
120+
121+
```azurepowershell-interactive
122+
Remove-AzResourceGroup -Name exampleRG
123+
```
124+
125+
---
126+
127+
## Next steps
128+
129+
In this quickstart, you created a key vault and a secret using Bicep and then validated the deployment. To learn more about Key Vault and Bicep, continue on to the articles below.
130+
131+
- Read an [Overview of Azure Key Vault](../general/overview.md)
132+
- Learn more about [Bicep](../../azure-resource-manager/bicep/overview.md)
133+
- Review the [Key Vault security overview](../general/security-features.md)

‎articles/key-vault/secrets/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ items:
2929
href: quick-create-go.md
3030
- name: Java
3131
href: quick-create-java.md
32+
- name: Bicep
33+
displayName: ARM, Resource Manager, Template
34+
href: quick-create-bicep.md
3235
- name: ARM template
3336
displayName: Resource Manager
3437
href: quick-create-template.md

0 commit comments

Comments
 (0)