Retrieve storage account access keys from a bicep module

Question

is it possible to retrieve a Storage Account's Access Key when deploying the Storage Account via a Bicep module?

My parent bicep creates a storage account using a module file, and it then needs an Access Key but I cannot get it working in a way that's secure:

Parent Bicep

module functionAppStorageModule 'storage-account.bicep' = {
  name: 'functionAppStorage'
  params: {
    ...
  }
}

resource functionApp 'Microsoft.Web/sites@2021-03-01' = {
  name: functionAppName
  location: location
  kind: 'functionapp'
  properties: {
    siteConfig: {
      appSettings: [
        {
          name: 'store_key'
          value: ???
        }
      ]
    }
  }
}

I can get it working if I set an output on the module file, and use that output in the parent bicep:

Module Bicep

output storageAccountStr string = 'AccountKey=${listKeys(storageAccount.id, storageAccount.apiVersion).keys[0].value}'

Parent Bicep

properties: {
        siteConfig: {
          appSettings: [
            {
              name: 'store_key'
              value: functionAppStorageModule.outputs.storageAccountStr 
            }
          ]
        }
      }

But this does not seem secure to me as the key appears in plain text in Deployments' Output section on the Azure portal.

Alternatively, I may work around by deploying the storage account beforehand without the use of a module file, as the use of modules seems to be the issue, but just would like to know what I'm trying above is impossible?

Thanks

Answer 1

If you create the function app in a different module, this should work.

storage-account.bicep file:

param storageAccountName string
...

// Create the storage account
resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: storageAccountName
  ...
}

// return the name
output name string = storageAccount.name

function-app.bicep file:

...
param storageAccountName string 

// Get a reference to the existing storage
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' existing = {
  name: storageAccountName
}

// Create the function app
resource functionApp 'Microsoft.Web/sites@2021-03-01' = {
  ...
  properties: {
    siteConfig: {
      appSettings: [
        {
          name: 'store_key'
          // Here we can securely get the access key
          value: 'AccountKey=${storageAccount.listKeys().keys[0].value}'
        }
      ]
    }
  }
}

Then in your main.bicep:

// Create the storage account
module storage 'storage-account.bicep' = {
  name: 'functionAppStorage'
  params: {
    storageAccountName: storageAccountName
    ...
  }
}

// create the function app once the storage has been created
module functionApp 'function-app.bicep' = {
  name: 'functionApp'
  params: {
    ...
    // depends on storage module
    storageAccountName: storage.outputs.name
  }
}

Answer 2

I found the answer. Here's an example of how to rewrite the external listKeys() call to use a helper function from the resource.

Old:

AzureWebJobsStorage: 'DefaultEndpointsProtocol=https;AccountName=${res_functionStorage.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${listKeys(res_functionStorage.id, res_functionStorage.apiVersion).keys[0].value}'

New:

AzureWebJobsStorage: 'DefaultEndpointsProtocol=https;AccountName=${res_functionStorage.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${res_functionStorage.listKeys().keys[0].value}'