az keyvault secret show: Usage & Common CI Errors
Read a secret value from Azure Key Vault.
az keyvault secret show retrieves a secret from Azure Key Vault. The common pitfall is the vault’s permission model - RBAC versus access policies - which decides whether your CI identity can read at all.
What it does
az keyvault secret show --vault-name <vault> --name <secret> returns the secret object; --query value -o tsv extracts just the value for a shell variable. Key Vault uses either Azure RBAC or legacy access policies for authorization - the role/policy you need differs depending on which the vault is configured for.
Common usage
# Read a secret value into a variable
DB_PASS=$(az keyvault secret show \
--vault-name my-vault \
--name db-password \
--query value -o tsv)
# Show full metadata (version, attributes)
az keyvault secret show --vault-name my-vault --name db-passwordCommon error in CI: Forbidden / "does not have secrets get permission"
Reads fail with "(Forbidden) The user, group or application ... does not have secrets get permission on key vault" or "Caller is not authorized to perform action on resource". The cause is almost always the authorization model. Fix: if the vault uses Azure RBAC, assign the principal "Key Vault Secrets User" at the vault scope; if it uses access policies, add a policy granting get/list on secrets (az keyvault set-policy --secret-permissions get list). Also confirm network rules/firewall allow the runner, and that the --name and --vault-name are correct.
Key options
| Option | Purpose |
|---|---|
| --vault-name | Key Vault name |
| --name / -n | Secret name |
| --query value -o tsv | Extract just the secret value |
| --version | A specific secret version |
Using this in CI
Cloud CLIs behave differently on a runner than on your laptop. They assume no interactive terminal, no cached credentials, and no browser for device-code flows, so the same command that works locally can hang or fail on a runner.
- Authenticate with a short-lived OIDC token rather than a long-lived static key. GitHub Actions can exchange
id-token: writefor cloud credentials with no stored secret. - Always pass the non-interactive flag. Most cloud CLIs will otherwise prompt and hang until the job times out.
- Pin the CLI version. Cloud CLIs change output formats between minor releases, and any script parsing that output will break silently.
- Set the output format explicitly (
--output json) rather than relying on the default, which can differ by version and configuration profile.