Azure ARM template - check for existing Key Vault access policies

Question

I'm looking for away to determine if there are any access policies set for a given key vault and use that as a conditional in the template. If there are none I want to create the access policies otherwise creation should be skipped. How can i achieve this? Below is what I got right now with no conditional expression.

{
  "comments": "Create an Azure Key Vault and add an access policy in the key vault for the webb app.",
  "type": "Microsoft.KeyVault/vaults",
  "name": "[parameters('KeyVaultName')]",
  "apiVersion": "2018-02-14",
  "location": "[resourceGroup().location]",
  "properties": {
    "enabledForDeployment": false,
    "enabledForTemplateDeployment": false,
    "enabledForVolumeEncryption": false,
    "tenantId": "[reference(variables('identity_resource_id'), '2018-11-01', 'Full').identity.tenantId]",
    "accessPolicies": [
      {
        "tenantId": "[reference(variables('identity_resource_id'), '2018-11-01', 'Full').identity.tenantId]",
        "objectId": "[reference(variables('identity_resource_id'), '2018-11-01', 'Full').identity.principalId]",
        "permissions": {
          "secrets": [ "get", "list" ]
        }
      }
    ],
    "sku": {
      "name": "standard",
      "family": "A"
    }
  },
  "dependsOn": [
    "[resourceId('Microsoft.Web/Sites', variables('webSiteName'))]"
  ]
},

Why do you want to do this? Though I do know one major downside with access policies in ARM templates is that you have to define the whole set since it'll override all existing ones. Maybe that's the problem you are having? — juunas, Aug 30 '19 at 17:20
You can use Azure PowerShell to check for existing keys and then use ARM to create the ones you need additionally. — bit, Aug 31 '19 at 04:05

score 2 · Accepted Answer · answered Aug 31 '19 at 07:47

you cannot check anything with arm templates really, you need to either externalize this check or just always apply them. the downside would be - it would overwrite existing ones if you do it like this. alternatively you can add policies one by one in the template, that would workaround both things, kinda.

Azure ARM template - check for existing Key Vault access policies

1 Answers1