New-AzureRmResourceGroupDeployment with KeyVault reference in TemplateParameterObject

[kfrajtak]

Hi,

I have an Azure deployment template that creates a VM and joins it to a domain. The password (domainJoinUserPassword) of the user that has the rights to add a machine to a domain is stored in a key vault. The deployment works perfectly fine when parameters are defined in a JSON file (the key vault reference included). New-AzureRmResourceGroupDeployment commandlet is invoked with TemplateParameterFile parameter.

However, when I have modified the script to use hash table with parameter to be provided as a value of
TemplateParameterObject parameter, I am getting the following error

The provided value for the template parameter 'domainJoinUserPassword' at line '71' and column '36' is not valid.'

The hash table looks like this:

$parameters = @{
  ...
  domainJoinUserPassword = @{
    reference =  @{
      keyVault = @{
        id =  "/subscriptions/id/resourceGroups/Infra/providers/Microsoft.KeyVault/vaults/VaultName"
      }
      secretName = "MySecret"
    }
  }

How can I reference the key vault secret in the hash table? Or is this not the right approach and I should stick with the JSON file?

Thanks, Karel

[cormacpayne]

@ravbhatnagar Hey Gaurav, would you mind taking a look at this issue?

[4c74356b41]

no answer?

[AndyHerb]

It looks like this may be a duplicate of Issue #2336 (Add support for passing keyvault secrets through TemplateParameterObject)

In short, KeyVault references via TemplateParameterObject appear not to be supported at present.

[4c74356b41]

this is really sad.

[ravbhatnagar]

@TianoMS - Can you please investigate this?

[andyjballgit]

Hi All,

Just hit this - any update please ?

thanks in advance,
Andy

[AndyHerb]

@ravbhatnagar - is there any way someone at MS can provide an update? It's been around for a little while without any obvious action being taken, and it's painful for people to dynamically create template files just because we can't pass in the reference in the TemplateParameterObject ;)

Cheers

[andikrueger]

I just came across this issue my self and did find a nice workaround, that did the trick for me.

I did follow this docs section "Use Azure Key Vault to pass secure parameter value during deployment" on how to reference a secret with dynamic ID. This way I achieve the same outcome.

[4c74356b41]

well, this was there for ages, literally, but its extremely clunky and doesnt really help, i mean, it might be acceptable in some situations, but i'd rather have the real deal, instead of this half baked solution