KeyVault for CDK

[mitchdenny]

Creating this as a tracking issue for problems we are seeing in the KeyVault API for CDK.

Give the following CDK code:

var keyVault = construct.AddKeyVault(name: "mykv");
var secret = new KeyVaultSecret(construct, name: "mysecret");

We get the following Bicep:

targetScope = 'resourceGroup'

@description('')
param location string = resourceGroup().location


resource keyVault_OlyAsQ0DX 'Microsoft.KeyVault/vaults@2023-02-01' = {
  name: 'mykv-temp'
  location: location
  properties: {
    tenantId: tenant().tenantId
    sku: {
      name: 'standard'
      family: 'A'
    }
    enableRbacAuthorization: true
  }
}

resource keyVaultSecret_dPFd3FfoI 'Microsoft.KeyVault/vaults/secrets@2023-02-01' = {
  parent: keyVault_OlyAsQ0DX
  name: 'mysecret'
  location: location
  properties: {
    value: '00000000-0000-0000-0000-000000000000'
  }
}

output vaultUri string = keyVault_OlyAsQ0DX.properties.vaultUri

• How do we set a secret's value via the CDK; we anticipate that people will want to set secrets during deployment to capture parameter values. #42350
• KeyVault name should be generated based on the RG and resource name: toLower(take(concat('mykv', uniqueString(resourceGroup().id)), 24)) #42351
• We need role definitions for KeyVault in CDK. #42352

Tasks

Preview Give feedback

1. How do we set a secret's value via the CDK; we anticipate that people will want to set secrets during deployment to capture parameter values. #42350
   needs-triage +1
2. KeyVault name should be generated based on the RG and resource name: toLower(take(concat('mykv', uniqueString(resourceGroup().id)), 24)) #42351
   Client Provisioning +2
3. We need role definitions for KeyVault in CDK. #42352
   Client Provisioning +2
4. CDK new KeyVault(...) should not automatically define output. #42357
   Client Provisioning +2
5. CDK KeyVault throws when setting name to a parameter. #42392
   Client Provisioning +2