CI/CD for Azure Key Vault

Question

Hi Experts,

I am very new to Azure World.

I have created the key vault in my subscription and saved a few secrets which will be used by the logic app. I was able to create an ARM template for deployment using parameters and referring to this key-vault for the Dev environment and it is working fine.

Now, the challenge is the secret changes across environments and I have the below queries in my mind?

• How do deploy this key vault to higher environments?
• Do I need to create the key vault manually for the environments and refer to them in the variables section of the pipeline?
• If I deploy the key vault to a higher environment, Is it only the key-vault secret name that will be deployed, and do I need to store the secrets manually?
• In case, the secrets get changed do I have to run the pipeline or store the secrets manually?

Any inputs or leads will be really helpful for me.

Regards,
Pavan

Answer 1

You can deploy key vaults using ARM templates, this includes the vault itself and any secrets, keys etc. You will want to look at creating an ARM template (or to be honest I would recommend you move to using Bicep now) to create this, and parameterising this template so you can pass in any values that will change between environments. This way you can have a single template and different parameter sets for each environment.