You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Tutorial: Integrate Azure Key Vault in your Resource Manager template deployment
21
21
22
-
Learn how to retrieve secrets from Azure Key Vault and pass the secrets as parameters during Resource Manager deployment. The value is never exposed because you only reference its key vault ID. For more information, see [Use Azure Key Vault to pass secure parameter value during deployment](./resource-manager-keyvault-parameter.md)
22
+
Learn how to retrieve secrets from an Azure key vault and pass the secrets as parameters when you deploy Azure Resource Manager. The parameter value is never exposed, because you reference only its key vault ID. For more information, see [Use Azure Key Vault to pass secure parameter value during deployment](./resource-manager-keyvault-parameter.md).
23
23
24
-
In the [Set resource deployment order](./resource-manager-tutorial-create-templates-with-dependent-resources.md) tutorial, you create a virtual machine. You need to provide the virtual machine administrator username and password. Instead of providing the password, you can pre-store the password in an Azure Key Vault and then customize the template to retrieve the password from the key vault during the deployment.
24
+
In the [Set resource deployment order](./resource-manager-tutorial-create-templates-with-dependent-resources.md) tutorial, you create a virtual machine (VM). You need to provide the VM administrator username and password. Instead of providing the password, you can pre-store the password in an Azure key vault and then customize the template to retrieve the password from the key vault during the deployment.
27
27
28
28
This tutorial covers the following tasks:
29
29
30
30
> [!div class="checklist"]
31
31
> * Prepare a key vault
32
-
> * Open a QuickStart template
32
+
> * Open a quickstart template
33
33
> * Edit the parameters file
34
34
> * Deploy the template
35
35
> * Validate the deployment
@@ -43,25 +43,25 @@ If you don't have an Azure subscription, [create a free account](https://azure.m
43
43
44
44
To complete this article, you need:
45
45
46
-
*[Visual Studio Code](https://code.visualstudio.com/) with [Resource Manager Tools extension](./resource-manager-quickstart-create-templates-use-visual-studio-code.md#prerequisites).
47
-
* To increase security, use a generated password for the virtual machine administrator account. Here is a sample for generating a password:
46
+
*[Visual Studio Code](https://code.visualstudio.com/) with the [Resource Manager Tools extension](./resource-manager-quickstart-create-templates-use-visual-studio-code.md#prerequisites).
47
+
* To increase security, use a generated password for the VM administrator account. Here's a sample for generating a password:
48
48
49
49
```azurecli-interactive
50
50
openssl rand -base64 32
51
51
```
52
-
Verify the generated password meets the virtual machine password requirements. Each Azure service has specific password requirements. For the VM password requirements, see [What are the password requirements when creating a VM?](../virtual-machines/windows/faq.md#what-are-the-password-requirements-when-creating-a-vm).
52
+
Verify that the generated password meets the VM password requirements. Each Azure service has specific password requirements. For the VM password requirements, see [What are the password requirements when you create a VM?](../virtual-machines/windows/faq.md#what-are-the-password-requirements-when-creating-a-vm).
53
53
54
54
## Prepare a key vault
55
55
56
-
In this section, you create a key vault and add a secret to the key vault, so that you can retrieve the secret when you deploy your template. There are many ways to create a key vault. In this tutorial, you use Azure PowerShell to deploy a [Resource Manager template](https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/tutorials-use-key-vault/CreateKeyVault.json). This template does:
56
+
In this section, you create a key vault and add a secret to it, so that you can retrieve the secret when you deploy your template. There are many ways to create a key vault. In this tutorial, you use Azure PowerShell to deploy a [Resource Manager template](https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/tutorials-use-key-vault/CreateKeyVault.json). This template does the following:
57
57
58
-
* Create a key vault with the `enabledForTemplateDeployment` property enables. This property must be true before the template deployment process can access the secrets defined in this key vault.
59
-
* Add a secret to the key vault. The secret stores the virtual machine administrator password.
58
+
* Creates a key vault with the `enabledForTemplateDeployment` property enabled. This property must be *true* before the template deployment process can access the secrets that are defined in the key vault.
59
+
* Adds a secret to the key vault. The secret stores the VM administrator password.
60
60
61
61
> [!NOTE]
62
-
> If you (as the user to deploy the virtual machine template) are not the owner or the contributor of the key vault, the Owner or a Contributor of the key vault must grant you the access to the Microsoft.KeyVault/vaults/deploy/action permission for the key vault. For more information, see [Use Azure Key Vault to pass secure parameter value during deployment](./resource-manager-keyvault-parameter.md)
62
+
> As the user who's deploying the virtual machine template, if you're not the Owner of or a Contributor to the key vault, the Owner or a Contributor must grant you access to the *Microsoft.KeyVault/vaults/deploy/action* permission for the key vault. For more information, see [Use Azure Key Vault to pass a secure parameter value during deployment](./resource-manager-keyvault-parameter.md).
63
63
64
-
To run the following PowerShell script, select **Try it** to open the Cloud shell. To paste the script, right-click the shell pane, and then select **Paste**.
64
+
To run the following Azure PowerShell script, select **Try it** to open Azure Cloud Shell. To paste the script, right-click the shell pane, and then select **Paste**.
65
65
66
66
```azurepowershell-interactive
67
67
$projectName = Read-Host -Prompt "Enter a project name that is used for generating resource names"
* The resource group name is the project name with **rg** appended. To make it easier to [clean up the resources created in this tutorial](#clean-up-resources), use the same project name and resource group name when you [deploy the next template](#deploy-the-template).
84
-
* The default name for the secret name is **vmAdminPassword**. It is hardcoded in the template.
85
-
* To be able for the template to retrieve the secret, you must enable an access policy called **Enable access to Azure Resource Manager for template deployment** for the key vault. This policy is enabled in the template. For more information about this access policy, see [Deploy key vaults and secrets](./resource-manager-keyvault-parameter.md#deploy-key-vaults-and-secrets).
81
+
> [!IMPORTANT]
82
+
> * The resource group name is the project name, but with **rg** appended to it. To make it easier to [clean up the resources that you created in this tutorial](#clean-up-resources), use the same project name and resource group name when you [deploy the next template](#deploy-the-template).
83
+
> * The default name for the secret is **vmAdminPassword**. It's hardcoded in the template.
84
+
> * To enable the template to retrieve the secret, you must enable an access policy called "Enable access to Azure Resource Manager for template deployment" for the key vault. This policy is enabled in the template. For more information about the access policy, see [Deploy key vaults and secrets](./resource-manager-keyvault-parameter.md#deploy-key-vaults-and-secrets).
86
85
87
-
The template has one output value called **keyVaultId**. Write down the value. You need this ID when you deploy the virtual machine. The Resource ID format is:
86
+
The template has one output value, called *keyVaultId*. Write down the ID value for later use, when you deploy the virtual machine. The resource ID format is:
When you copy and paste the ID, the ID might be broken into multiple lines. You must merge the lines and trim the extra spaces.
92
+
When you copy and paste the ID, it might be broken into multiple lines. Merge the lines and trim the extra spaces.
94
93
95
-
To validate the deployment, run the following PowerShell command in the same shell pane to retrieve the secret in clear text. The command only works in the same shell session because it uses a variable $keyVaultNamedefined in the previous PowerShell script.
94
+
To validate the deployment, run the following PowerShell command in the same shell pane to retrieve the secret in clear text. The command works only in the same shell session, because it uses the variable *$keyVaultName*, which is defined in the preceding PowerShell script.
Now you have prepared a key vault and a secret, the following sections show you how to customize an existing template to retrieve the secret during the deployment.
100
+
Now you've prepared a key vault and a secret. The following sections show you how to customize an existing template to retrieve the secret during the deployment.
102
101
103
-
## Open a Quickstart template
102
+
## Open a quickstart template
104
103
105
-
Azure QuickStart Templates is a repository for Resource Manager templates. Instead of creating a template from scratch, you can find a sample template and customize it. The template used in this tutorial is called [Deploy a simple Windows VM](https://azure.microsoft.com/resources/templates/101-vm-simple-windows/).
104
+
Azure Quickstart Templates is a repository for Resource Manager templates. Instead of creating a template from scratch, you can find a sample template and customize it. The template that's used in this tutorial is called [Deploy a simple Windows VM](https://azure.microsoft.com/resources/templates/101-vm-simple-windows/).
106
105
107
-
1. From Visual Studio Code, select **File**>**Open File**.
108
-
2. In **File name**, paste the following URL:
106
+
1. In Visual Studio Code, select **File** > **Open File**.
107
+
108
+
1. In the **File name** box, paste the following URL:
3. Select **Open** to open the file. It is the same scenario used in [Tutorial: create Azure Resource Manager templates with dependent resources](./resource-manager-tutorial-create-templates-with-dependent-resources.md).
115
-
4. There are five resources defined by the template:
114
+
1. Select **Open** to open the file. The scenario is the same as the one that's used in [Tutorial: Create Azure Resource Manager templates with dependent resources](./resource-manager-tutorial-create-templates-with-dependent-resources.md).
115
+
The template defines five resources:
116
116
117
117
* `Microsoft.Storage/storageAccounts`. See the [template reference](https://docs.microsoft.com/azure/templates/Microsoft.Storage/storageAccounts).
118
118
* `Microsoft.Network/publicIPAddresses`. See the [template reference](https://docs.microsoft.com/azure/templates/microsoft.network/publicipaddresses).
119
119
* `Microsoft.Network/virtualNetworks`. See the [template reference](https://docs.microsoft.com/azure/templates/microsoft.network/virtualnetworks).
120
120
* `Microsoft.Network/networkInterfaces`. See the [template reference](https://docs.microsoft.com/azure/templates/microsoft.network/networkinterfaces).
121
121
* `Microsoft.Compute/virtualMachines`. See the [template reference](https://docs.microsoft.com/azure/templates/microsoft.compute/virtualmachines).
122
122
123
-
It is helpful to get some basic understanding of the template before customizing it.
124
-
5. Select **File**>**Save As** to save a copy of the file to your local computer with the name **azuredeploy.json**.
125
-
6. Repeat steps 1-4 to open the following URL, and then save the file as **azuredeploy.parameters.json**.
123
+
It's helpful to have some basic understanding of the template before you customize it.
124
+
125
+
1. Select **File** > **Save As**, and then save a copy of the file to your local computer with the name *azuredeploy.json*.
126
+
127
+
1. Repeat steps 1-3 to open the following URL, and then save the file as *azuredeploy.parameters.json*.
* **adminUsername**: name the virtual machine administrator account.
156
-
* **dnsLabelPrefix**: name the dnsLabelPrefix.
158
+
* **adminUsername**: The name of the virtual machine administrator account.
159
+
* **dnsLabelPrefix**: Name the dnsLabelPrefix value.
157
160
158
-
See an example in the previous screenshot.
161
+
For examples of names, see the preceding image.
159
162
160
-
4. Save the changes.
163
+
1. Save the changes.
161
164
162
165
## Deploy the template
163
166
164
-
Follow the instructions in [Deploy the template](./resource-manager-tutorial-create-templates-with-dependent-resources.md#deploy-the-template) to deploy the template. You must upload both **azuredeploy.json** and **azuredeploy.parameters.json** to the Cloud shell, and then use the following PowerShell script to deploy the template:
167
+
Follow the instructions in [Deploy the template](./resource-manager-tutorial-create-templates-with-dependent-resources.md#deploy-the-template). Upload both *azuredeploy.json* and *azuredeploy.parameters.json* to Cloud Shell, and then use the following PowerShell script to deploy the template:
165
168
166
169
```azurepowershell
167
170
$projectName = Read-Host -Prompt "Enter the same project name that is used for creating the key vault"
When you deploy the template, use the same resource group as the key vault. It makes easier when you clean up the resources. You only need to delete one resource group instead of two.
180
+
When you deploy the template, use the same resource group that you used in the key vault. This approach makes it easier for you to clean up the resources, because you need to delete only one resource group instead of two.
178
181
179
182
## Validate the deployment
180
183
181
-
After you have successfully deployed the virtual machine, test the login using the password stored in the key vault.
184
+
After you've successfully deployed the virtual machine, test the sign-in credentials by using the password that's stored in the key vault.
182
185
183
186
1. Open the [Azure portal](https://portal.azure.com).
1. Select **Download RDP File**, and then follow the instructions to sign in to the virtual machine by using the password that's stored in the key vault.
187
191
188
192
## Clean up resources
189
193
190
-
When the Azure resources are no longer needed, clean up the resources you deployed by deleting the resource group.
194
+
When you no longer need your Azure resources, clean up the resources that you deployed by deleting the resource group.
191
195
192
196
```azurepowershell-interactive
193
197
$projectName = Read-Host -Prompt "Enter the same project name that is used for creating the key vault"
In this tutorial, you retrieved a secret from Azure Key Vault, and used the secret in your template deployment. To learn how to create linked templates, see:
205
+
In this tutorial, you retrieved a secret from your Azure key vault. You then used the secret in your template deployment. To learn how to create linked templates, see:
0 commit comments