Azure bicep 使用来自不同资源组的密钥保管库

Question

I've an Azure Key Vault(KV) that has shared secrets and a cert that needs to be pulled into different deployments.

Eg DEV, TEST, UAT, Production all have their own key vaults BUT need access to the shared KV for wild card ssl cert.

I've tried a number of approaches but each has errors. I'm doing something similar for KV within the deployment resource group without issues

Is it possible to have this and then use it as a module? Something like this...

sharedKV.bicep

var kvResourceGroup = 'project-shared-rg'
var subscriptionId = subscription().id
var name = 'project-shared-kv'

resource project_shared_kv 'Microsoft.KeyVault/vaults@2021-06-01-preview' existing = {
  name: name
  scope: resourceGroup(subscriptionId, kvResourceGroup )
}

And then uses like: template.bicep

module shared_kv './sharedKeyVault/template.bicep' = {
 name: 'sharedKeyVault'
}


resource add_secrect 'Microsoft.KeyVault/vaults/secrets@2021-06-01-preview' = {
  name: '${shared_kv.name}/mySecretKey'
  properties: {
    contentType: 'string'
    value: 'secretValue'
    attributes: {
      enabled: true
    }
  }
}

Answer 1

If you need to target a different resourceGroup (and/or sub) than the rest of the deployment, the module's scope property needs to target that RG/sub. eg

module shared_kv './sharedKeyVault/template.bicep' = {
  scope: resourceGroup(kvSubscription, kvResourceGroupName)
  name: 'sharedKeyVault'
  params: {
    subId: kvSubscription
    rg: kvResourceGroupName
    ...
  }
}

Ideally, the sub/rg for the KV would be passed in to the module rather than hardcoded (which you probably knew, but just in case...)