Make appSettings a secure object by default

[weikanglim]

This allows users to set secret values as app settings for appservice, function host services. App service handle secrets in app settings by defaults, so there isn't any additional configuration there.

Fixes https://github.com/Azure/azure-dev-pr/issues/1563

[azure-sdk]

Repoman Generation Results

Repoman pushed changes to remotes for the following projects:

Project: todo-csharp-cosmos-sql

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-csharp-cosmos-sql -b pr/2575

View Changes | Compare Changes

---

Project: todo-csharp-sql-swa-func

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-csharp-sql-swa-func -b pr/2575

View Changes | Compare Changes

---

Project: todo-csharp-sql

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-csharp-sql -b pr/2575

View Changes | Compare Changes

---

Project: todo-java-mongo-aca

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-java-mongo-aca -b pr/2575

View Changes | Compare Changes

---

Project: todo-java-mongo

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-java-mongo -b pr/2575

View Changes | Compare Changes

---

Project: todo-nodejs-mongo-aca

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo-aca -b pr/2575

View Changes | Compare Changes

---

Project: todo-nodejs-mongo-aks

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo-aks -b pr/2575

View Changes | Compare Changes

---

Project: todo-nodejs-mongo-swa-func

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo-swa-func -b pr/2575

View Changes | Compare Changes

---

Project: todo-nodejs-mongo

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo -b pr/2575

View Changes | Compare Changes

---

Project: todo-python-mongo-aca

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-python-mongo-aca -b pr/2575

View Changes | Compare Changes

---

Project: todo-python-mongo-swa-func

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-python-mongo-swa-func -b pr/2575

View Changes | Compare Changes

---

Project: todo-python-mongo

Remote: azure-samples-staging

Branch: pr/2575

You can initialize this project with:

azd init -t Azure-Samples/todo-python-mongo -b pr/2575

View Changes | Compare Changes

---

[wbreza]

This allows users to set secret values as app settings for appservice, function host services. App service handle secrets in app settings by defaults, so there isn't any additional configuration there.

Is there a user reported issue that this resolves? If so, please add a link/reference.

[weikanglim]

@wbreza Linked.

[wbreza]

@wbreza Linked.

@weikanglim After reviewing the linked issue its unclear on whether this would workaround the issue since we're still using a param object vs a single string as suggested.

We may want to look into using keyvault reference from the app service app setting.
https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#source-app-settings-from-key-vault

[weikanglim]

@wbreza Marking an object as secure works the same way as a string (docs). This makes sense as the input is passed as a JSON string between ARM deployments.

Here are two deployment instances to take note of:

• Before - az deployment group show -n func-api-x6dmhh6f7fyru-functions -g rg-weilim-insecure-1
• After - az deployment group show -n func-api-m4chjvfmvhyyu-functions -g rg-weilim-secure-1