I have got a working bicep deployment script which creates resources such a sql server databases, virtual machines etc in an idempotent manner after several deployment test runs, dropping and creating the resources several times. However the problem with the script is this, I have hardcoded the credentials within the bicep parameter file, I am looking to improve this by removing the credentials and having it generated by the deployment, stored in key vault and then retried from key vault during deployment.

This means that key vault controls the secret which is what I want to achieve, I do not want to be the one controlling the secret.

I have got a PowerShell code snippet that will generate a random password

-Join("ABCDabcd&@#$%941GHSdf1414>9fDFG1^(1AA".tochararray() | Get-Random -Count 12 | % {[char]$_})

what I am struggling with is havingputting together a bicep code that will get the output of the snippet above or any other similar solution, storing it within key vault and either outputing the secret detail so that it can be used elsewhere in the code.

I have come across this

However I have doubts with this approach, if the deployment is executed 100 times, it will generate a password with 100 versions in key vault especially during deployment testing.

Perhaps another way would be to check if the secret exists first, if it does do not generate a new secret.

I find it easier to write a Powershell script to tackle this problem, but doing so creates a problem from a bicep IaC perspective, the key vault needs to be created by bicep.

Any thoughts on how to tackle this issue?