I am trying to create a container registry through Azure Bicep, and as part of that, also create access tokens inside of it.

My .bicep file includes this section:

param tokenExpiry string = dateTimeAdd(utcNow(), 'P30D')

resource MyToken 'Microsoft.ContainerRegistry/registries/tokens@2022-12-01' = {
  parent: containerRegistry
  name: 'MyToken'
  properties: {
    status: 'enabled'
    scopeMapId: resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', containerRegistry.name, '_repositories_pull')
    credentials: {
      passwords: [
        {
           name: 'password1'
           expiry: tokenExpiry
          }
      ]
    }
  }
}

However, upon running the deployment, this fails:

[{"code":"PasswordCannotBeAdded","message":"New passwords can be added only through 'generateCredentials'.

I’ve tried adding a value property to the password (like I would for a key vault), but that also fails: {"code":"PasswordPropertiesImmutable","message":"Password properties cannot be changed. To retain the password, please provide an empty value for a password. To add a new password please use 'generateCredentials'.

I’m not seeing a way to call generateCredentials from within a bicep script, and the only search result was a mention of the New-AzContainerRegistryToken PowerShell cmdlet.

Am I maybe misusing bicep here? I’d like to ensure that there’s only ever a specific set of Access Tokens in the registry, and if I want to refresh them, I’d just run bicep again.

Can I do this, or would I have to create the token without any credentials and then have to create the passwords separately through the REST API?