1. Packages
  2. Packages
  3. Azure Classic
  4. API Docs
  5. keyvault
  6. getSecret

We recommend using Azure Native.

Viewing docs for Azure v4.42.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi
Go to latest version
Schema (JSON)
pulumi/pulumi-azure

azure.keyvault.getSecret

azure logo

We recommend using Azure Native.

Viewing docs for Azure v4.42.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi
Go to latest version
Schema (JSON)
pulumi/pulumi-azure

    Use this data source to access information about an existing Key Vault Secret.

    Example Usage

    using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var example = Output.Create(Azure.KeyVault.GetSecret.InvokeAsync(new Azure.KeyVault.GetSecretArgs
        {
            Name = "secret-sauce",
            KeyVaultId = data.Azurerm_key_vault.Existing.Id,
        }));
        this.SecretValue = example.Apply(example => example.Value);
    }

    [Output("secretValue")]
    public Output<string> SecretValue { get; set; }
}

    package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/keyvault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := keyvault.LookupSecret(ctx, &keyvault.LookupSecretArgs{
			Name:       "secret-sauce",
			KeyVaultId: data.Azurerm_key_vault.Existing.Id,
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("secretValue", example.Value)
		return nil
	})
}

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const example = azure.keyvault.getSecret({
    name: "secret-sauce",
    keyVaultId: data.azurerm_key_vault.existing.id,
});
export const secretValue = example.then(example => example.value);

    import pulumi
import pulumi_azure as azure

example = azure.keyvault.get_secret(name="secret-sauce",
    key_vault_id=data["azurerm_key_vault"]["existing"]["id"])
pulumi.export("secretValue", example.value)

    Example coming soon!

    Using getSecret

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getSecret(args: GetSecretArgs, opts?: InvokeOptions): Promise<GetSecretResult>
function getSecretOutput(args: GetSecretOutputArgs, opts?: InvokeOptions): Output<GetSecretResult>
    def get_secret(key_vault_id: Optional[str] = None,
               name: Optional[str] = None,
               opts: Optional[InvokeOptions] = None) -> GetSecretResult
def get_secret_output(key_vault_id: Optional[pulumi.Input[str]] = None,
               name: Optional[pulumi.Input[str]] = None,
               opts: Optional[InvokeOptions] = None) -> Output[GetSecretResult]
    func LookupSecret(ctx *Context, args *LookupSecretArgs, opts ...InvokeOption) (*LookupSecretResult, error)
func LookupSecretOutput(ctx *Context, args *LookupSecretOutputArgs, opts ...InvokeOption) LookupSecretResultOutput

    > Note: This function is named LookupSecret in the Go SDK.

    public static class GetSecret 
{
    public static Task<GetSecretResult> InvokeAsync(GetSecretArgs args, InvokeOptions? opts = null)
    public static Output<GetSecretResult> Invoke(GetSecretInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)
public static Output<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)

    fn::invoke:
  function: azure:keyvault/getSecret:getSecret
  arguments:
    # arguments dictionary

    The following arguments are supported:

    KeyVaultId string
    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.
    Name string
    Specifies the name of the Key Vault Secret.
    KeyVaultId string
    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.
    Name string
    Specifies the name of the Key Vault Secret.
    keyVaultId String
    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.
    name String
    Specifies the name of the Key Vault Secret.
    keyVaultId string
    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.
    name string
    Specifies the name of the Key Vault Secret.
    key_vault_id str
    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.
    name str
    Specifies the name of the Key Vault Secret.
    keyVaultId String
    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.
    name String
    Specifies the name of the Key Vault Secret.

    getSecret Result

    The following output properties are available:

    ContentType string
    The content type for the Key Vault Secret.
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyVaultId string
    Name string
    Tags Dictionary<string, string>
    Any tags assigned to this resource.
    Value string
    The value of the Key Vault Secret.
    Version string
    The current version of the Key Vault Secret.
    VersionlessId string
    ContentType string
    The content type for the Key Vault Secret.
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyVaultId string
    Name string
    Tags map[string]string
    Any tags assigned to this resource.
    Value string
    The value of the Key Vault Secret.
    Version string
    The current version of the Key Vault Secret.
    VersionlessId string
    contentType String
    The content type for the Key Vault Secret.
    id String
    The provider-assigned unique ID for this managed resource.
    keyVaultId String
    name String
    tags Map<String,String>
    Any tags assigned to this resource.
    value String
    The value of the Key Vault Secret.
    version String
    The current version of the Key Vault Secret.
    versionlessId String
    contentType string
    The content type for the Key Vault Secret.
    id string
    The provider-assigned unique ID for this managed resource.
    keyVaultId string
    name string
    tags {[key: string]: string}
    Any tags assigned to this resource.
    value string
    The value of the Key Vault Secret.
    version string
    The current version of the Key Vault Secret.
    versionlessId string
    content_type str
    The content type for the Key Vault Secret.
    id str
    The provider-assigned unique ID for this managed resource.
    key_vault_id str
    name str
    tags Mapping[str, str]
    Any tags assigned to this resource.
    value str
    The value of the Key Vault Secret.
    version str
    The current version of the Key Vault Secret.
    versionless_id str
    contentType String
    The content type for the Key Vault Secret.
    id String
    The provider-assigned unique ID for this managed resource.
    keyVaultId String
    name String
    tags Map<String>
    Any tags assigned to this resource.
    value String
    The value of the Key Vault Secret.
    version String
    The current version of the Key Vault Secret.
    versionlessId String

    Package Details

    Repository
    Azure Classic pulumi/pulumi-azure
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azurerm Terraform Provider.
    azure logo

    We recommend using Azure Native.

    Viewing docs for Azure v4.42.0 (Older version)
    published on Monday, Mar 9, 2026 by Pulumi
    Go to latest version
    Schema (JSON)
    pulumi/pulumi-azure
      Try Pulumi Cloud free. Your team will thank you.