Azure Key Vault Understanding

Question

The following github deployment allows me to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore the password is never put in plain text in the template parameter file.

Can someone explain what is meant with the statement:

'the password is never put in plain text in the template parameter file?'

Answer 1

If you don't use Key Vault, even adminPassword type is securestring , When you enter the adminPassword during deployment, it is showing as plaintext, not ****** . It is not safe. But if you use Key Vault, the password stores in Key Vault and encrypted save, other could not see your password.

In template, you should configure your template using Key Vault like below:

"adminPassword": {
  "reference": {
    "keyVault": {
      "id": "/subscriptions/XXXXXXX/resourceGroups/resourceGroupName/providers/Microsoft.KeyVault/vaults/vaultName"
    },
    "secretName": "secretName"
  }
},

Please refer to the similar question:How to hide password in shell script duing ARM template deployment .