title: Adding Secrets and access policy to existing shared keyvault using ARM
body: <p>I was searching the web after information in regards to the question I have to add secrets and access policies to an existing keyvault in azure shade by others applications using ARM.</p>
  <p>I read this <a href="https://www.codeisahighway.com/there-is-a-new-way-to-reference-managed-identity-in-arm-template/" rel="nofollow noreferrer">documentation</a>.</p>
  <p>What I'm worried about is in regards to if anything existing will be overwritten on deleted as I'm creating a new template and parameter file in my services &quot;solution&quot; so to speak.</p>
  <p>And I know that I have my CICD pipelines in devops set to &quot;incremental&quot; in regards to what it should be updating an creating.</p>
  <p>Anyone have a crystal clear understanding regarding this?</p>
  <p>Thanks in advance!</p>
  <p><strong>UPDATE:</strong></p>
  <p>So I think I managed to get it right here after all.</p>
  <p>I Created a new key vault resource and added a couple of secrets and some access policies to emulate a situation of an already created resource which I want to add new secrets to.</p>
  <p>Then I created this template:</p>
  <pre><code>{
    &quot;$schema&quot;: &quot;https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#&quot;,
    &quot;contentVersion&quot;: &quot;1.0.0.0&quot;,
    &quot;parameters&quot;: {
      &quot;keyVault&quot;: {
        &quot;type&quot;: &quot;string&quot;
      },
      &quot;Credentials1&quot;: {
        &quot;type&quot;: &quot;secureString&quot;
      },
      &quot;SecretName1&quot;: {
        &quot;type&quot;: &quot;string&quot;
      },
      &quot;Credentials2&quot;: {
        &quot;type&quot;: &quot;secureString&quot;
      },
      &quot;SecretName2&quot;: {
        &quot;type&quot;: &quot;string&quot;
      }
    },
    &quot;variables&quot;: {
    },
    &quot;resources&quot;: [
  
      {
        &quot;type&quot;: &quot;Microsoft.KeyVault/vaults/secrets&quot;,
        &quot;name&quot;: &quot;[concat(parameters('keyVault'), '/', parameters('SecretName1'))]&quot;,
        &quot;apiVersion&quot;: &quot;2015-06-01&quot;,
        &quot;properties&quot;: {
          &quot;contentType&quot;: &quot;text/plain&quot;,
          &quot;value&quot;: &quot;[parameters('Credentials1')]&quot;
        }
      },
      {
        &quot;type&quot;: &quot;Microsoft.KeyVault/vaults/secrets&quot;,
        &quot;name&quot;: &quot;[concat(parameters('keyVault'), '/', parameters('SecretName2'))]&quot;,
        &quot;apiVersion&quot;: &quot;2015-06-01&quot;,
        &quot;properties&quot;: {
          &quot;contentType&quot;: &quot;text/plain&quot;,
          &quot;value&quot;: &quot;[parameters('Credentials2')]&quot;
        }
      }
    ],
    &quot;outputs&quot;: {}
  }
  </code></pre>
  <p>What I've learned is that if an existing shared key vault exists which I want to add some secrets to I only have to define the sub resources, in this case the secrets to be added to the existing key vault.</p>
  <p>so this worked an resulted in not modifying anything else in the existing key vault except adding the new secrets.</p>
  <p>even though this is not a fully automated way of adding a whole new key vault setup related to a new service, as one doesn't connect the new resources correctly by adding their principal ID's (identity). Its good for now as I don't have to add each secret manually. Though I do have to add the principal ID's manually.</p>