ARM Template with KeyVault - SQL vs. VM - azure

Question

I have an Azure ARM template which creates a SQL Server and a VM. Both refer to the KeyVault to get the Admin-Password:
"resources": [
{
"type": "Microsoft.Sql/servers",
"kind": "v12.0",
"name": "[variables('vSqlServerName')]",
"tags": {
"Environment": "[parameters('pEnvironment')]",
"DisplayName": "SQL Server",
"UDID": "SQLServer" // Unique Deployment ID (for later reference)
},
"apiVersion": "[variables('vSqlAPIVersion')]",
"location": "[resourceGroup().location]",
"properties": {
"administratorLogin": "[variables('vSqlAdminUser')]",
"administratorLoginPassword":{
"reference": {
"keyVault": {
"id": "[concat(resourceGroup().id, '/providers/Microsoft.KeyVault/vaults/', variables('vKeyVaultName'))]"
},
"secretName": "SQLDW-AdminPassword"
}
},
"version": "12.0"
},
},
{
"type": "Microsoft.Compute/virtualMachines",
"name": "[concat(variables('vSqlVMName'), variables('vSuffixVM'))]",
"apiVersion": "2015-06-15",
"location": "[resourceGroup().location]",
"properties": {
"hardwareProfile": {
"vmSize": "Standard_DS5_v2"
}
"osProfile": {
"computerName": "[variables('vSqlVMName')]",
"adminUsername": "[variables('vWinAdminUser')]",
"windowsConfiguration": {
"provisionVMAgent": true,
"enableAutomaticUpdates": true
},
"secrets": [],
"adminPassword": {
"reference": {
"keyVault": {
"id": "[concat(resourceGroup().id, '/providers/Microsoft.KeyVault/vaults/', variables('vKeyVaultName'))]"
},
"secretName": "VM-LocalAdminPassword"
}
}
}
}
]
this works just fine for SQL, but not for the VM
the error i get is this:
{
11:16:27 - [ERROR] "target": "vm.properties.osProfile.adminPassword",
11:16:27 - [ERROR] "message": "Unexpected character encountered while parsing value: {.
11:16:27 - [ERROR] Path 'properties.osProfile.adminPassword', line 1, position 785."
11:16:27 - [ERROR] },

Answer 1

You cannot use Key Vault reference directly in the template with VM's for sure. So you have to use a parameter file for that.
So in your parameter file you would have:
...
"adminPassword": {
"reference": {
"keyVault": {
"id": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.KeyVault/vaults/{}"
},
"secretName": "secretName"
}
},
...
and in the template:
"osProfile": {
"computerName": "[variables('vSqlVMName')]",
"adminUsername": "[variables('vWinAdminUser')]",
"windowsConfiguration": {
"provisionVMAgent": true,
"enableAutomaticUpdates": true
},
"secrets": [],
"adminPassword": "[parameters('adminPassword')]"
}
And you would use the parameters file to supply parameters to the deploment, or, alternatively, you can convert VM deployment to a nested template deployment, that way you can pass parameters directly from your parent template, without parameters file.
Refer to this example. It doesn't deal with VM's but the idea is the same.