AzureKeyVaultResourceExtensions Methods

AddAzureKeyVault(IDistributedApplicationBuilder, string)extensionIResourceBuilder<AzureKeyVaultResource>

Adds an Azure Key Vault resource to the application model.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultResource> AddAzureKeyVault(
        this IDistributedApplicationBuilder builder,
        string name)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs#L66-L147

Parameters

builderIDistributedApplicationBuilderThe Hosting.IDistributedApplicationBuilder.

namestringThe name of the resource. This name will be used as the connection string name when referenced in a dependency.

Returns

IResourceBuilder<AzureKeyVaultResource>A reference to the ApplicationModel.IResourceBuilder`1.

Remarks

By default references to the Azure Key Vault resource will be assigned the following roles:

- KeyVaultBuiltInRole.KeyVaultAdministrator

These can be replaced by calling AzureKeyVaultResourceExtensions.WithRoleAssignments.

Managing Secrets:

Use the AzureKeyVaultResourceExtensions.AddSecret methods to add secrets to the Key Vault:

var builder = DistributedApplication.CreateBuilder(args);

var vault = builder.AddAzureKeyVault("vault");

// Add a secret from a parameter
var secret = builder.AddParameter("secretParam", secret: true);
vault.AddSecret("my-secret", secret);

// Add a secret from a reference expression
var connectionString = ReferenceExpression.Create(
    $"Server={server};Database={db}");
vault.AddSecret("connection-string", connectionString);

// Get a reference to an existing secret
var existingSecret = vault.GetSecret("existing-secret");

AddSecret(IResourceBuilder<AzureKeyVaultResource>, string, IResourceBuilder<ParameterResource>)extensionIResourceBuilder<AzureKeyVaultSecretResource>

Adds a secret to the Azure Key Vault resource with the value from a parameter resource.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string name,
        IResourceBuilder<ParameterResource> parameterResource)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

namestringThe name of the secret. Must follow Azure Key Vault naming rules.

parameterResourceIResourceBuilder<ParameterResource>The parameter resource containing the secret value.

Returns

IResourceBuilder<AzureKeyVaultSecretResource>A reference to the ApplicationModel.IResourceBuilder`1.

AddSecret(IResourceBuilder<AzureKeyVaultResource>, string, ParameterResource)extensionIResourceBuilder<AzureKeyVaultSecretResource>

Adds a secret to the Azure Key Vault resource with the value from a parameter resource.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string name,
        ParameterResource parameterResource)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

namestringThe name of the secret. Must follow Azure Key Vault naming rules.

parameterResourceParameterResourceThe parameter resource containing the secret value.

Returns

IResourceBuilder<AzureKeyVaultSecretResource>A reference to the ApplicationModel.IResourceBuilder`1.

AddSecret(IResourceBuilder<AzureKeyVaultResource>, string, ReferenceExpression)extensionIResourceBuilder<AzureKeyVaultSecretResource>

Adds a secret to the Azure Key Vault resource with the value from a reference expression.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string name,
        ReferenceExpression value)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs#L313-L321

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

namestringThe name of the secret. Must follow Azure Key Vault naming rules.

valueReferenceExpressionThe reference expression containing the secret value.

Returns

IResourceBuilder<AzureKeyVaultSecretResource>A reference to the ApplicationModel.IResourceBuilder`1.

AddSecret(IResourceBuilder<AzureKeyVaultResource>, string, string, IResourceBuilder<ParameterResource>)extensionIResourceBuilder<AzureKeyVaultSecretResource>

Adds a secret to the Azure Key Vault resource with the value from a parameter resource.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string name,
        string secretName,
        IResourceBuilder<ParameterResource> parameterResource)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

namestringThe name of the secret resource.

secretNamestringThe name of the secret. Must follow Azure Key Vault naming rules.

parameterResourceIResourceBuilder<ParameterResource>The parameter resource containing the secret value.

Returns

IResourceBuilder<AzureKeyVaultSecretResource>A reference to the ApplicationModel.IResourceBuilder`1.

AddSecret(IResourceBuilder<AzureKeyVaultResource>, string, string, ParameterResource)extensionIResourceBuilder<AzureKeyVaultSecretResource>

Adds a secret to the Azure Key Vault resource with the value from a parameter resource.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string name,
        string secretName,
        ParameterResource parameterResource)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

namestringThe name of the secret resource.

secretNamestringThe name of the secret. Must follow Azure Key Vault naming rules.

parameterResourceParameterResourceThe parameter resource containing the secret value.

Returns

IResourceBuilder<AzureKeyVaultSecretResource>A reference to the ApplicationModel.IResourceBuilder`1.

AddSecret(IResourceBuilder<AzureKeyVaultResource>, string, string, ReferenceExpression)extensionIResourceBuilder<AzureKeyVaultSecretResource>

Adds a secret to the Azure Key Vault resource with the value from a reference expression.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string name,
        string secretName,
        ReferenceExpression value)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs#L374-L382

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

namestringThe name of the secret resource.

secretNamestringThe name of the secret. Must follow Azure Key Vault naming rules.

valueReferenceExpressionThe reference expression containing the secret value.

Returns

IResourceBuilder<AzureKeyVaultSecretResource>A reference to the ApplicationModel.IResourceBuilder`1.

GetSecret(IResourceBuilder<AzureKeyVaultResource>, string)extensionIAzureKeyVaultSecretReference

Gets a secret reference for the specified secret name from the Azure Key Vault resource.

public static class AzureKeyVaultResourceExtensions
{
    public static IAzureKeyVaultSecretReference GetSecret(
        this IResourceBuilder<AzureKeyVaultResource> builder,
        string secretName)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs#L238-L240

Parameters

builderIResourceBuilder<AzureKeyVaultResource>The Azure Key Vault resource builder.

secretNamestringThe name of the secret.

Returns

IAzureKeyVaultSecretReferenceA reference to the secret.

WithRoleAssignments(IResourceBuilder<T>, IResourceBuilder<AzureKeyVaultResource>, KeyVaultBuiltInRole[])extensionIResourceBuilder<T>

Assigns the specified roles to the given resource, granting it the necessary permissions on the target Azure Key Vault resource. This replaces the default role assignments for the resource.

public static class AzureKeyVaultResourceExtensions
{
    public static IResourceBuilder<T> WithRoleAssignments<T>(
        this IResourceBuilder<T> builder,
        IResourceBuilder<AzureKeyVaultResource> target,
        params KeyVaultBuiltInRole[] roles)
    {
        // ...
    }
}

AzureKeyVaultResourceExtensions.cs

Parameters

builderIResourceBuilder<T>The resource to which the specified roles will be assigned.

targetIResourceBuilder<AzureKeyVaultResource>The target Azure Key Vault resource.

rolesKeyVaultBuiltInRole[]The built-in Key Vault roles to be assigned.

Returns

IResourceBuilder<T>The updated ApplicationModel.IResourceBuilder`1 with the applied role assignments.

Remarks

Assigns the KeyVaultReader role to the 'Projects.Api' project.

var builder = DistributedApplication.CreateBuilder(args);

var vault = builder.AddAzureKeyVault("vault");

var api = builder.AddProject<Projects.Api>("api")
  .WithRoleAssignments(vault, KeyVaultBuiltInRole.KeyVaultReader)
  .WithReference(vault);