I have got a synapse workspace bicep code below, trying to add double encryption but currently faced with the error below.Tried different things to no avail, the issue here is that the code was decompiled from an ARM template, so not sure if the key syntax is correct.
key: {
name: 'default'
keyVaultUrl: 'https://my-keyvault.vault.azure.net/keys/my-key/xxxxxxxx'
}
{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidValuesForRequestParameters","message":"Values for request parameters are invalid: keyvaultproperties.keyvaulturi."}]}
resource create_synapse_workspace 'Microsoft.Synapse/workspaces@2021-06-01' = {
name: synapse_workspace_name
location: location
tags: my_tags
identity: {
type: 'SystemAssigned,UserAssigned'
userAssignedIdentities: {
'${synapse_identity.id}': {}
}
}
properties: {
defaultDataLakeStorage: {
createManagedPrivateEndpoint: false
accountUrl: accountURL
filesystem: filesystem
}
// encryption: {}
encryption: {
cmk: {
kekIdentity: {
userAssignedIdentity: mi
useSystemAssignedIdentity: false
}
key: {
name: 'default'
keyVaultUrl: 'https://my-keyvault.vault.azure.net/keys/my-key/xxxxxxxx'
}
}
}
managedVirtualNetwork: 'default'
managedResourceGroupName: null
sqlAdministratorLogin: adminaccount
sqlAdministratorLoginPassword: adminpassword
privateEndpointConnections: [
]
managedVirtualNetworkSettings: {
preventDataExfiltration: false
}
workspaceRepositoryConfiguration: {
accountName: account_name
collaborationBranch: branch
repositoryName: repo
rootFolder: folder
type: type
}
trustedServiceBypassEnabled: false
publicNetworkAccess: 'Disabled'
}
}
The keyVaultUrl have the pattern:
var keyVaultUrl = 'https://${encryptionKeyVaultName}${environment().suffixes.keyvaultDns}/keys/${encryptionKeyName}'
and has the result https://xxxx.vault.azure.net/keys/xxxx but yours is https://my-keyvault.vault.azure.net/keys/my-key/xxxxxxxx
OR
You can set keyvault after synapse workspace been created.
@description('Required. Used to activate the workspace after a customer managed key is provided.')
param isActiveCMK bool
resource cMKKeyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
name: ''
resource cMKKey 'keys@2023-02-01' existing = {
name: name
}
}
resource workspace 'Microsoft.Synapse/workspaces@2021-06-01' existing = {
name: ''
}
resource key 'Microsoft.Synapse/workspaces/keys@2021-06-01' = {
name: ''
parent: workspace
properties: {
isActiveCMK: isActiveCMK
keyVaultUrl: cMKKeyVault::cMKKey.properties.keyUri
}
}
Where I cite. template1 template2
0