[Issue] Using Access Token as a bicep parameter

[fangjian0423]

hi,

As I know, the variables defined in main.parameters.json file will be replaced by azd, and there are 2 ways to do that:

1. replace by the values of .azure/{env}/.env file or environment variables

"param": {
    "value": "${AZURE_ACCESS_TOKEN}"
 }

2. use secretOrRandomPassword keyword to get value from KeyVault to replace variables

"param": {
    "value": "$(secretOrRandomPassword ${AZURE_KEY_VAULT_NAME} sqlAdminPassword)"
},

Is there any ways to use access token as a bicep parameter?

If I use bicep directly, I can get access token as a parameter, not sure azd can do it or not:

az deployment sub create --location centralus --template-file test.bicep --parameters accessToken=$(az account get-access-token --resource-type oss-rdbms --output tsv --query accessToken)

Thanks.

[rajeshkamal5050]

Don't think azd supports this from the CLI params today @jongio @ellismg?

[weikanglim]

@fangjian0423 You're right that the types of expansion azd does on the parameters file would be:

1. Environment variable/ env file substitution
2. secretOrRandomPassword for keyvault

azure-dev/cli/azd/pkg/infra/provisioning/bicep/bicep_provider.go

Lines 712 to 749 in 446c00c

	// loadParameters reads the parameters file template for environment/module specified by Options,
	// doing environment and command substitutions, and returns the values.
	func (p *BicepProvider) loadParameters(
	ctx context.Context,
	asyncContext *async.InteractiveTaskContextWithProgress[*DeploymentPlan, *DeploymentPlanningProgress],
	) (map[string]azure.ArmParameterValue, error) {
	parametersTemplateFilePath := p.parametersTemplateFilePath()
	log.Printf("Reading parameters template file from: %s", parametersTemplateFilePath)
	parametersBytes, err := os.ReadFile(parametersTemplateFilePath)
	if err != nil {
	return nil, fmt.Errorf("reading parameter file template: %w", err)
	}
	replaced, err := envsubst.Eval(string(parametersBytes), func(name string) string {
	if val, has := p.env.Values[name]; has {
	return val
	}
	return os.Getenv(name)
	})
	if err != nil {
	return nil, fmt.Errorf("substituting environment variables inside parameter file: %w", err)
	}
	if cmdsubst.ContainsCommandInvocation(replaced, cmdsubst.SecretOrRandomPasswordCommandName) {
	cmdExecutor := cmdsubst.NewSecretOrRandomPasswordExecutor(p.azCli)
	replaced, err = cmdsubst.Eval(ctx, replaced, cmdExecutor)
	if err != nil {
	return nil, fmt.Errorf("substituting command output inside parameter file: %w", err)
	}
	}
	var armParameters azure.ArmParameterFile
	if err := json.Unmarshal([]byte(replaced), &armParameters); err != nil {
	return nil, fmt.Errorf("error unmarshalling Bicep template parameters: %w", err)
	}
	return armParameters.Parameters, nil
	}

What is the scenario here? Would love to understand more.

[fangjian0423]

Sorry for late reply @weikanglim .

What is the scenario here? Would love to understand more.

I want to contribute postgresql passwordless AZD template. By reading this docs, it needs Access Token as password to login postgresql server:

psql "host=$AZ_DATABASE_SERVER_NAME.postgres.database.azure.com user=$CURRENT_USERNAME dbname=postgres port=5432 password=$(az account get-access-token --resource-type oss-rdbms --output tsv --query accessToken) sslmode=require" < create_ad_user_mi.sql

So I need Access Token as a parameter to login.

BTW, I use terraform to achieve this and create 2 AZD templates: todo-java-postgresql-terraform and todo-java-postgresql-aca-terraform. Could you pls take a look? thanks.

[jongio]

My concern with this approach is the access token and being unsure what risk we are introducing by putting that in a parameter. Can we figure out a way to do this without using the access token as a param?

[fangjian0423]

My concern with this approach is the access token and being unsure what risk we are introducing by putting that in a parameter.

It's really a good question. Seems we don't have a good solution to resolve it now.

Can we figure out a way to do this without using the access token as a param?

Terraform won't put access token in a parameter. It use provisioner "local-exec" to run script in local, we could get rid of risk. So I contribute that 2 templates which infra was provided by terraform.

[jongio]

@weikanglim - Thoughts on how we can do this without needing to have access token as a param?

[vhvb1989]

IIRC, @ellismg recently updated the way azd creates and parses the ARM parameters file.
Since we are loading the Json into memory during runtime (before doing the deploy request), I think we should be able to replace the value in memory directly. Azd can define a placeholder to support access token and use it from main.parameters.json (at the infra folder level), or even by using a prefix for the name of the parameter directly within the bicep files.

[jongio]

I think we can figure out a better arch to not require this as a param at all

[weikanglim]

@fangjian0423 It looks like you're intending to use that access token to pass to a SQL client CLI and execute the SQL script on the database. We're working on adding script hooks, that would allow you to run scripts locally with your shell (pwsh / bash) post-deploy or post-provision. Would that solve your problem?

@jongio Speaking generally for sensitive parameters. Currently for bicep, we support parameter passing either via envsubst in the parameters.json, or via prompting for any unset values. If extremely worried about storing secrets in env variables, currently the prompting could work to avoid that. Alternatively, a product improvement would be to add support for CLI parameters flags passing via -param or something similar.

Note that both bicep and terraform both support sensitive value decorators that would prevent the value from showing up in logs. The question is whether we also worry about the in-memory process environment variable storage. For access tokens, I can see that passing as a CLI flag with an inline expansion to be most ideal.

[fangjian0423]

@weikanglim

It looks like you're intending to use that access token to pass to a SQL client CLI and execute the SQL script on the database.

Exactly.

We're working on adding script hooks, that would allow you to run scripts locally with your shell (pwsh / bash) post-deploy or post-provision. Would that solve your problem?

Sounds good. I have another question: would the script hooks have the parameters which I wanted?

Here is a example for terraform template:

The parameters I wanted could passed here, then used by script.