Azure Key Vault

Manage data plane objects in Azure Key Vault, such as secrets, keys and certificates.

Community Maintained

Version	0.0.1
Artifact	br:ghcr.io/anthony-c-martin/bicep-ext-keyvault:0.0.1
Source	github.com/anthony-c-martin/bicep-ext-keyvault
Publisher	anthony-c-martin
Licence	MIT
Category	Azure

Installation

Register the extension in bicepconfig.json:

{
  "experimentalFeaturesEnabled": {
    "localDeploy": true,
    "ociEnabled": true
  },
  "implicitExtensions": [],
  "extensions": {
    "keyvault": "br:ghcr.io/anthony-c-martin/bicep-ext-keyvault:0.0.1"
  }
}

Then reference it from your Bicep file:

extension keyvault

Configuration

Configuration is supplied using extension keyvault with { ... }.

Property	Type	Attributes	Description
managedHsmUri	string		The URI of the Managed HSM, e.g. 'https://myhsm.managedhsm.azure.net/'. Individual resources may override this with their own 'managedHsmUri' property.
purgeOnDelete	bool		Permanently purge objects after deleting them, instead of leaving them in a soft-deleted state. Defaults to false.
recoverSoftDeleted	bool		Recover objects that are in a soft-deleted state instead of failing to create them. Defaults to false.
vaultUri	string		The URI of the Key Vault, e.g. 'https://myvault.vault.azure.net/'. Individual resources may override this with their own 'vaultUri' property.

Authentication

The extension reaches Key Vault over its data plane and authenticates with DefaultAzureCredential, which picks up environment variables, workload identity, managed identity or an Azure CLI login — whichever is available. There is no credential to set in the extension configuration.

The identity you sign in with needs data plane permissions, granted through either Azure RBAC roles such as Key Vault Secrets Officer or a vault access policy, depending on how the vault is configured.

Targeting a vault

Set vaultUri once on the extension and every resource inherits it:

extension keyvault with {
  vaultUri: 'https://contoso.vault.azure.net/'
}

Individual resources can override it with their own vaultUri, which is how the Replicating across vaults sample writes the same secret into more than one vault.

Managed HSM resources use managedHsmUri instead:

extension keyvault with {
  managedHsmUri: 'https://contoso.managedhsm.azure.net/'
}

Soft delete

Key Vault keeps deleted objects in a soft-deleted state, which can cause a later deployment to fail because the name is still taken. Two settings control how the extension handles this:

Setting	Effect
recoverSoftDeleted	Recovers a soft-deleted object instead of failing to create it.
purgeOnDelete	Permanently purges an object when it is deleted, rather than soft-deleting it.

Both default to false. purgeOnDelete is convenient for short-lived test vaults, but it removes the safety net that soft delete exists to provide — leave it off for anything you would mind losing.

Notes

• This extension manages data plane objects. The vault itself is still created with the standard Microsoft.KeyVault/vaults Azure resource type.
• Because the data plane is reached directly, the machine running the deployment needs network access to the vault. Vaults restricted to a private endpoint or a firewall will reject requests from elsewhere.
• Secret values are marked sensitive, so pass them as @secure() parameters rather than writing them into the template.

Samples

6 example Bicep files are available under Samples.

Resource types

This extension exposes 9 resource types, documented under Reference.

Reference generated from ghcr.io/anthony-c-martin/bicep-ext-keyvault:0.0.1 on 2026-08-23.