Azure KeyVault for Aspire via CDK

[mitchdenny]

KeyVault migration to CDK. There are some outstanding issues in the CDK outlined here:

Azure/azure-sdk-for-net#42349

Usage:

var keyvault = builder.AddAzureKeyVaultConstruct("mykv", (construct, keyVault) =>
{
    var secret = new KeyVaultSecret(construct, name: "mysecret");
    secret.AssignParameter(x => x.Properties.Value, signaturesecret);
});

Bicep produced:

targetScope = 'resourceGroup'

@description('')
param location string = resourceGroup().location

@description('')
param principalId string

@description('')
param principalType string

@description('')
param signaturesecret string


resource keyVault_IKWI2x0B5 'Microsoft.KeyVault/vaults@2023-02-01' = {
  name: toLower(take(concat('mykv', uniqueString(resourceGroup().id)), 24))
  location: location
  properties: {
    tenantId: tenant().tenantId
    sku: {
      name: 'standard'
      family: 'A'
    }
    enableRbacAuthorization: true
  }
}

resource roleAssignment_Z4xb36awa 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: keyVault_IKWI2x0B5
  name: guid(keyVault_IKWI2x0B5.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483'))
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')
    principalId: principalId
    principalType: principalType
  }
}

resource keyVaultSecret_7ClrhkRcM 'Microsoft.KeyVault/vaults/secrets@2023-02-01' = {
  parent: keyVault_IKWI2x0B5
  name: 'mysecret'
  location: location
  properties: {
    value: signaturesecret
  }
}

output vaultUri string = keyVault_IKWI2x0B5.properties.vaultUri

Currently you can use the configureResource callback to add secrets. Although it would be fairly trivial to add a secret via an extension method on the app model itself. The wrinkle is that what makes sense from a consumption point of view. Currently the SecretClient takes a vaultUri, the uri to a KV secret itself isn't something you can wrap a secret around.

It actually makes more sense for KeyVault to behave like Cosmos where AddDatabase(...) doesn't result in a IResourceBuilder<CosmosDatabaseResource> but instead just adds another secret to the pile.

[davidfowl]

Can I create a secret that references a parameter.

[mitchdenny]

Yes. Take a look in the CdkSample ... signaturesecret.