ChangeVault Docs

Overview

Use a deploymentScripts resource to run a shell script after your Bicep deployment completes. The script calls the ChangeVault API with the deployment details.

Prerequisites

A user-assigned managed identity or service principal with at least Contributor access on the resource group
The identity must be attached to the deploymentScripts resource

Setup

1. Pass the API key as a secure parameter

@secure()
param changeVaultApiKey string

Store the value in Azure Key Vault and reference it from your main.bicepparam file, or pass it from an Azure Pipeline variable.

2. Add the deployment script resource

@secure()
param changeVaultApiKey string

param deploymentTitle string = 'Bicep deployment: ${deployment().name}'

resource logToChangeVault 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
  name: 'log-changevault'
  location: resourceGroup().location
  kind: 'AzureCLI'
  properties: {
    azCliVersion: '2.50.0'
    timeout: 'PT5M'
    retentionInterval: 'PT1H'
    environmentVariables: [
      {
        name: 'CHANGEVAULT_API_KEY'
        secureValue: changeVaultApiKey
      }
      {
        name: 'TITLE'
        value: deploymentTitle
      }
    ]
    scriptContent: '''
      curl -sS -X POST https://app.changevault.dev/api/changes \
        -H "x-api-key: $CHANGEVAULT_API_KEY" \
        -H "Content-Type: application/json" \
        -d "{\"title\": \"$TITLE\", \"risk_level\": \"low\", \"status\": \"completed\", \"tags\": [\"bicep\", \"azure\"]}"
    '''
  }
}

Full template example

// main.bicep
targetScope = 'resourceGroup'

@secure()
param changeVaultApiKey string

@description('The environment being deployed to')
@allowed(['prod', 'staging', 'dev'])
param environment string = 'prod'

// ... your actual resources ...

resource logToChangeVault 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
  name: 'log-changevault-${uniqueString(deployment().name)}'
  location: resourceGroup().location
  kind: 'AzureCLI'
  properties: {
    azCliVersion: '2.50.0'
    timeout: 'PT5M'
    retentionInterval: 'PT1H'
    environmentVariables: [
      {
        name: 'CHANGEVAULT_API_KEY'
        secureValue: changeVaultApiKey
      }
    ]
    scriptContent: '''
      curl -sS -X POST https://app.changevault.dev/api/changes \
        -H "x-api-key: $CHANGEVAULT_API_KEY" \
        -H "Content-Type: application/json" \
        -d "{
          \"title\": \"Bicep deploy: ${deployment().name}\",
          \"description\": \"Environment: ${environment}\nResource group: ${resourceGroup().name}\",
          \"risk_level\": \"low\",
          \"status\": \"completed\",
          \"tags\": [\"bicep\", \"azure\", \"${environment}\"]
        }"
    '''
  }
}

Passing the API key from Azure Pipelines

- task: AzureCLI@2
  displayName: Deploy Bicep template
  inputs:
    azureSubscription: your-service-connection
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      az deployment group create \
        --resource-group my-rg \
        --template-file main.bicep \
        --parameters changeVaultApiKey=$(CHANGEVAULT_API_KEY) environment=prod

API access requires the Pro plan or higher.

Azure Bicep