Best Practice for BICEP to Ignore Overwriting Existing KeyVault Secrets

Question

I have the following GUID that is generated in my BICEP module and used as a value in a KeyVault secret

param keyVaultName string
param apiKey string = newGuid()

resource apikey_secret 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
  name: '${keyVaultName}/ApiKey'
  properties:{
    value: apiKey
    attributes:{
      enabled: true
    }
  }
}

Every time I run the BICEP files this GUID is generated and replaces the previous value. My preference is for this to only be generated on the first run and then ignored if it exits on any subsequent run.

I came across this solution which uses tags to track existing secrets and then conditionals within the BICEP file checking to see if the tag exists.

I feel like there should be a more elegant solution than having to manage tags in addition to secrets but cannot find anything in the docs so far.

Answer 1

There isn't any way to do a "deploy only if it doesn't exist" in bicep/ARM - ARM is declarative so will always seek the goal specified in the template.

Another option you can consider is to use a deterministic guid that way it won't change, but someone with knowledge of how the function works could "determine" the secret value, e.g.

@secure
param apiKey string = guid(apikey_secret.id)

Nit - in your code snippet the param is not secure so someone with permission to the deployment at scope can retrieve the value.