How to get the Key's latest version in Output section of an ARM Template?

Question

I need to get the latest version of the Key in the output section of the arm template(generated inside Azure's Key Vault) which is generated from an ARM template . How can I get that ? I need to use the output as input for my next Job in pipeline.

Answer 1

Newer versions of the Key Vault provider for ARM deployments support creating keys, which you can reference as shown in the example ARM template below.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vaultName": {
      "type": "string"
    },
    "objectId": {
      "type": "string",
      "metadata": {
        "description": "The unique principal ID within the tenant to which key wrap and unwrap permissions are given."
      }
    },
    "keyName": {
      "type": "string",
      "defaultValue": "test-key"
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]"
    },
    "tenantId": {
      "type": "string",
      "defaultValue": "[subscription().tenantId]",
      "metadata": {
        "description": "Tenant ID of the ACtive Directory to authenticate access. Default is the current subscription's tenant ID."
      }
    }
  },
  "variables": {
    "apiVersion": "2019-09-01"
  },
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "[variables('apiVersion')]",
      "name": "[parameters('vaultName')]",
      "location": "[parameters('location')]",
      "properties": {
        "sku": {
          "family": "A",
          "name": "standard"
        },
        "tenantId": "[parameters('tenantId')]",
        "accessPolicies": [
          {
            "tenantId": "[parameters('tenantId')]",
            "objectId": "[parameters('objectId')]",
            "permissions": {
              "keys": [
                "wrapKey",
                "unwrapKey"
              ]
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.KeyVault/vaults/keys",
      "apiVersion": "[variables('apiVersion')]",
      // The name must include the vault name and key name separated by a slash.
      "name": "[concat(parameters('vaultName'), '/', parameters('keyName'))]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('vaultName'))]"
      ],
      "properties": {
        "kty": "RSA",
        "keySize": 4096,
        "keyOps": [
          "wrapKey",
          "unwrapKey"
        ]
      }
    }
  ],
  "outputs": {
    "keyName": {
      "type": "string",
      "value": "[parameters('keyName')]"
    },
    // Despite the delimited resource name above, we need to construct a 2-parameter resource ID to reference the created key.
    "keyUri": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName'))).keyUri]"
    },
    "keyVersionUri": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName'))).keyUriWithVersion]"
    }
  }
}

Note the comments about how you create and reference the keys differently. Simply using the reference() template function against the delimited name results in an invalid template, so you must construct a resourceId() despite being in the sample template.

Adjust access policies as needed. This example gives the principal you pass key wrap and unwrap capabilities, which you can use for block encryption ciphers.

To use this template (e.g. saved as keyvault-template.json),

az group create -n rg-mytestkv -l westus2
az deployment group create -g rg-mytestkv --template-file keyvault-template.json --parameters vaultName=mytestkv objectId=$(az account show --query id)