W3cubDocs

/Ansible

azure.azcollection.azure_keyvault_secret lookup – Read secret from Azure Key Vault.

Note

This lookup plugin is part of the azure.azcollection collection (version 3.7.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install azure.azcollection. You need further requirements to be able to use this lookup plugin, see Requirements for details.

To use it in a playbook, specify: azure.azcollection.azure_keyvault_secret.

New in azure.azcollection 1.12.0

Synopsis

  • This lookup returns the content of secret saved in Azure Key Vault.
  • When ansible host is MSI enabled Azure VM, user don’t need provide any credential to access to Azure Key Vault.

Requirements

The below requirements are needed on the local controller node that executes this lookup.

  • requests
  • azure

Terms

Parameter

Comments

Terms

string / required

Secret name, version can be included like secret_name/secret_version.

Keyword parameters

This describes keyword parameters of the lookup. These are the values key1=value1, key2=value2 and so on in the following examples: lookup('azure.azcollection.azure_keyvault_secret', key1=value1, key2=value2, ...) and query('azure.azcollection.azure_keyvault_secret', key1=value1, key2=value2, ...)

Parameter

Comments

client_id

string

Client id of service principal that has access to the Azure Key Vault

cloud_type

string

Specify which cloud, such as azure, usgovcloudapi.

secret

string

Secret of the service principal.

tenant_id

string

Tenant id of service principal.

use_cli

string

When use_cli=True, get the ‘az lgin’ credential authentication, default if false.

use_msi

string

MSI token autodiscover, default is true.

vault_url

string / required

Url of Azure Key Vault.

Notes

Note

  • When keyword and positional parameters are used together, positional parameters must be listed before keyword parameters: lookup('azure.azcollection.azure_keyvault_secret', term1, term2, key1=value1, key2=value2) and query('azure.azcollection.azure_keyvault_secret', term1, term2, key1=value1, key2=value2)
  • If version is not provided, this plugin will return the latest version of the secret.
  • If ansible is running on Azure Virtual Machine with MSI enabled, client_id, secret and tenant isn’t required.
  • For enabling MSI on Azure VM, please refer to this doc https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/
  • After enabling MSI on Azure VM, remember to grant access of the Key Vault to the VM by adding a new Acess Policy in Azure Portal.
  • If MSI is not enabled on ansible host, it’s required to provide a valid service principal which has access to the key vault.
  • To authenticate via service principal, pass client_id, secret and tenant_id or set environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET and AZURE_TENANT_ID.
  • Authentication via az login is also supported.
  • To use a plugin from a collection, please reference the full namespace, collection name, and lookup plugin name that you want to use.

Return Value

Key

Description

Return value

string

secret content string

Returned: success

Authors

  • Hai Cao (@tk5eq)
  • Marcin Slowikowski (@msl0)

© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/azure/azcollection/azure_keyvault_secret_lookup.html