Hotspot Question You have a project Azure DevOps. You plan to create a build pipeline that will deploy resources by using Azure Resource Manager templates. The templates will reference secretes stored

Question

Exhibit

Answer Area

• typeMicrosoft.KeyVault/vaults
  Microsoft.KeyVault/vaultsMicrosoft.Resources/deploymentMicrosoft.Subscription/subscriptions
• Template content propertydeployment
  deploymenttemplatetemplateLink

Explanation

This question tests knowledge of Azure Resource Manager (ARM) template structure needed to dynamically reference Azure Key Vault secrets during deployment, specifically using a linked or nested template with a dynamic resource ID.

Approach. To dynamically generate the resource ID of a Key Vault during template deployment, you need to use a 'Microsoft.Resources/deployments' resource type (nested/linked template) with a 'templateLink' or inline template. The outer (parent) template should use the 'resourceId()' function to dynamically construct the Key Vault resource ID at deployment time using the subscription ID, resource group name, and Key Vault name as parameters. The Key Vault reference must be placed in a separate linked template because ARM evaluates Key Vault secret references at deployment time and requires the resource ID to be resolvable dynamically - this is achieved by placing the Key Vault reference in a nested deployment resource with 'expressionEvaluationOptions' set to 'inner' scope. Specifically, the template should include a nested deployment (type: Microsoft.Resources/deployments) and within the parameters block of that nested template, use a 'reference' object with a 'keyVault' property containing the dynamically computed 'id' using the resourceId() function.

Concept tested. ARM template dynamic Key Vault secret referencing using nested/linked templates and the resourceId() function to generate Key Vault resource IDs at deployment time, rather than hardcoding them.

Reference. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter

No community discussion yet for this question.