Deployment Parameter Secret Management

Synopsis

Intended end result: Keep deployment parameters synchronized across local files, App Configuration, and Key Vault.

How this page gets you there: Use publish/restore scripts with dry-run safety to preview, update, and recover deployment inputs consistently.

The deployment parameters (credentials, keys, config) for CONDOR are stored as the AICondorDeploymentParam secret in Key Vault kv-wfcacaalertca-hub-001 (subscription a8e28801-b3eb-445c-87f6-ac9f0470aa86). Two scripts in azure\infrastructure\scripts\ manage this secret.

Both scripts default to the correct subscription, vault, and secret name. Both support -DryRun for a safe preview.

Publish parameters to Key Vault

Reads azure\infrastructure\parameters.bicepparam and writes a new secret version.

Preview (no Azure write):

cd azure\infrastructure
.\scripts\publish-AICondorDeploymentParamSecret.ps1 -DryRun

Publish:

cd azure\infrastructure
.\scripts\publish-AICondorDeploymentParamSecret.ps1

Run after any change to credentials, camera lists, Entra IDs, or other secret-backed params.

Restore parameters from Key Vault

Retrieves the secret and writes (or updates) azure\infrastructure\parameters.bicepparam. If the file already exists it is backed up as parameters.<yyyyMMdd-HHmmss>.bicepparam before the new file is written. Backup files match the *.bicepparam .gitignore rule and will not be committed.

Preview (no file writes):

cd azure\infrastructure
.\scripts\restore-AICondorDeploymentParamToBicepParams.ps1 -DryRun

Restore:

cd azure\infrastructure
.\scripts\restore-AICondorDeploymentParamToBicepParams.ps1

Run on a fresh clone, after rotating a credential, or before deploying on a new machine.