azure.azcollection.azure_keyvault_secret lookup – Read secret from Azure Key Vault.
This lookup plugin is part of the azure.azcollection collection (version 1.13.0).
You might already have this collection installed if you are using the
It is not included in
To check whether it is installed, run
ansible-galaxy collection list.
To install it, use:
ansible-galaxy collection install azure.azcollection.
To use it in a playbook, specify:
New in version 1.12.0: of azure.azcollection
This lookup returns the content of secret saved in Azure Key Vault.
When ansible host is MSI enabled Azure VM, user don’t need provide any credential to access to Azure Key Vault.
The below requirements are needed on the local controller node that executes this lookup.
Secret name, version can be included like secret_name/secret_version.
Client id of service principal that has access to the Azure Key Vault
Secret of the service principal.
Tenant id of service principal.
Url of Azure Key Vault.
If version is not provided, this plugin will return the latest version of the secret.
If ansible is running on Azure Virtual Machine with MSI enabled, client_id, secret and tenant isn’t required.
For enabling MSI on Azure VM, please refer to this doc https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/
After enabling MSI on Azure VM, remember to grant access of the Key Vault to the VM by adding a new Acess Policy in Azure Portal.
If MSI is not enabled on ansible host, it’s required to provide a valid service principal which has access to the key vault.
To use a plugin from a collection, please reference the full namespace, collection name, and lookup plugin name that you want to use.