What is the best practice for creating Azure SQL with ARM template and Key vault

Question

When we create Azure SQL using ARM templates, we have to specify admin username and password using parameters. In the same ARM template, we can create Key Vaults and use key vault values as variables and use them in the server username and password. But in order to create key vault values, again we have to specify the password in the parameter.json file. So there, we lose the point of having key vault for secure database credentials. We can not create the SQL server without admin username and password either as per my knowledge. How can we overcome this?

Answer 1

I have tested in my environment.

If you are creating the Key Vault secrets using ARM Template through a pipeline, the best practice is to use variable groups.

Go to your project in the DevOps Organization --> Expand Pipelines --> Click on Library --> Click on + Variable Group --> Give the Variable Group Name and Add the Variable --> Click on Save

Go to Pipelines --> Select your Pipeline --> Click on Variables --> Click on Variable Groups --> Click on Link Variable Group --> Select your variable Group --> Click on Link

Now you can pass these variables to your Pipeline for the creation of Key Vault Secrets.

You can use the Key Vault secrets for the creation of Azure SQL.