azure.azcollection.azure_keyvault_secret lookup – Read secret from Azure Key Vault.

Note

This lookup plugin is part of the azure.azcollection collection (version 1.13.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install azure.azcollection.

To use it in a playbook, specify: azure.azcollection.azure_keyvault_secret.

New in version 1.12.0: of azure.azcollection

Synopsis

  • This lookup returns the content of secret saved in Azure Key Vault.

  • When ansible host is MSI enabled Azure VM, user don’t need provide any credential to access to Azure Key Vault.

Requirements

The below requirements are needed on the local controller node that executes this lookup.

  • requests

  • azure

  • msrest

Parameters

Parameter

Comments

_terms

string / required

Secret name, version can be included like secret_name/secret_version.

client_id

string

Client id of service principal that has access to the Azure Key Vault

secret

string

Secret of the service principal.

tenant_id

string

Tenant id of service principal.

vault_url

string / required

Url of Azure Key Vault.

Notes

Note

  • If version is not provided, this plugin will return the latest version of the secret.

  • If ansible is running on Azure Virtual Machine with MSI enabled, client_id, secret and tenant isn’t required.

  • For enabling MSI on Azure VM, please refer to this doc https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/

  • After enabling MSI on Azure VM, remember to grant access of the Key Vault to the VM by adding a new Acess Policy in Azure Portal.

  • If MSI is not enabled on ansible host, it’s required to provide a valid service principal which has access to the key vault.

  • To use a plugin from a collection, please reference the full namespace, collection name, and lookup plugin name that you want to use.

Return Values

Common return values are documented here, the following are the fields unique to this lookup:

Key

Description

_raw

string

secret content string

Returned: success

Authors

  • Hai Cao

Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.