Escaping variable group values when passing using in Azure CLI task - azure-devops

Question

I am using a variable group to store some secrets, that I want to deploy into a key vault as part of my pipeline.
I do this by passing the values as secret parameters to a bicep file via the Azure CLI.
My pipeline step looks like this:
- task: AzureCLI#2
displayName: deploy bicep template
inputs:
azureSubscription: ${{ parameters.azure_subscription }}
scriptType: 'ps'
scriptLocation: 'inlineScript'
inlineScript: |
az deployment group create `
--name foo.$(Build.BuildNumber) `
--resource-group my-rg-name `
--template-file $(Pipeline.Workspace)/iac/main.bicep `
--parameters environment='${{ parameters.environment }}' `
kv_secret_one='$(bd_kv_secret_one)' `
kv_secret_two='$(bd_kv_secret_two)'
Now, the issue is that these secrets could contain all sorts of special characters that break my script. So I found some suggestions that I could use double quotes inside the single quotes like this kv_secret_two='"$(bd_kv_secret_two)"'
However, if the value of the secret contains a " then the script breaks.
This leads me to think there must be a better way of doing this, but I cannot find it.
What is the correct way to pass --parameters so that they are escaped properly, no matter what characters the may contain?

Answer 1

You can do this with a bicep parameter file.
First, construct a parameter file including all your parameter values, escaped as necessary. You could do this in a script task for example.
Secondly, name that file when doing the deployment instead of listing individual parameters:
- task: AzureCLI#2
displayName: deploy bicep template
inputs:
azureSubscription: ${{ parameters.azure_subscription }}
scriptType: 'ps'
scriptLocation: 'inlineScript'
inlineScript: |
az deployment group create `
--name foo.$(Build.BuildNumber) `
--resource-group my-rg-name `
--template-file $(Pipeline.Workspace)/iac/main.bicep `
--parameters #main.parameters.json

Answer 2

You could check this document for double quotation in parameter, and edit your value to escape with the equivalent of the string "{\"key\": \"value\"}"