Share via

az vm secret

  • Reference

Manage VM secrets.

Commands

Name Description Type Status
az vm secret add

Add a secret to a VM.

 Core GA
az vm secret format

Transform secrets into a form that can be used by VMs and VMSSes.

 Core GA
az vm secret list

List secrets on a VM.

 Core GA
az vm secret remove

Remove a secret from a VM.

 Core GA

az vm secret add

Edit

Add a secret to a VM.

To install certificates on a virtual machine it is recommended to use the Azure Key Vault virtual machine extension for Linux or the Azure Key Vault virtual machine extension for Windows instead of az vm secret add.

az vm secret add --certificate
                 --keyvault
                 [--certificate-store]
                 [--ids]
                 [--name]
                 [--resource-group]
                 [--subscription]

Examples

Add a secret to a VM. (autogenerated)

az vm secret add --certificate {certificate} --keyvault {keyvault} --name MyVirtualMachine --resource-group MyResourceGroup

Required Parameters

--certificate

Key vault certificate name or its full secret URL.

--keyvault

Name or ID of the key vault.

Optional Parameters

--certificate-store

Windows certificate store names. Default: My.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--name -n

The name of the Virtual Machine. You can configure the default using az configure --defaults vm=<name>.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az vm secret format

Edit

Transform secrets into a form that can be used by VMs and VMSSes.

az vm secret format --secrets
                    [--certificate-store]
                    [--keyvault]
                    [--resource-group]

Examples

Create a self-signed certificate with the default policy, and add it to a virtual machine.

az keyvault certificate create --vault-name vaultname -n cert1 \
  -p "$(az keyvault certificate get-default-policy)"

secrets=$(az keyvault secret list-versions --vault-name vaultname \
  -n cert1 --query "[?attributes.enabled].id" -o tsv)

vm_secrets=$(az vm secret format -s "$secrets")
az vm create -g group-name -n vm-name --admin-username deploy  \
  --image Debian11 --secrets "$vm_secrets"

Required Parameters

--secrets -s

Space-separated list of key vault secret URIs. Perhaps, produced by 'az keyvault secret list-versions --vault-name vaultname -n cert1 --query "[?attributes.enabled].id" -o tsv'.

The command will attempt to resolve the vault ID for each secret. If it is unable to do so, specify the vault ID to use for all secrets using: --keyvault NAME --resource-group NAME | --keyvault ID.

Optional Parameters

--certificate-store

Windows certificate store names. Default: My.

--keyvault

Name or ID of the key vault.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az vm secret list

Edit

List secrets on a VM.

az vm secret list --name
                  --resource-group

Examples

List secrets on a VM. (autogenerated)

az vm secret list --name MyVirtualMachine --resource-group MyResourceGroup

Required Parameters

--name -n

The name of the Virtual Machine. You can configure the default using az configure --defaults vm=<name>.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az vm secret remove

Edit

Remove a secret from a VM.

az vm secret remove --keyvault
                    [--certificate]
                    [--ids]
                    [--name]
                    [--resource-group]
                    [--subscription]

Required Parameters

--keyvault

Name or ID of the key vault.

Optional Parameters

--certificate

Key vault certificate name or its full secret URL.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--name -n

The name of the Virtual Machine. You can configure the default using az configure --defaults vm=<name>.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.