title: How to listkeys on a storage account deployed via linked ARM template?
body: <p>Below I have a (simplified) Azure ARM Template to deploy a website which has in its appSettings the storage account. I originally passed the key via a string output parameter which works fine. </p>
  
  <p><strong>Storage Template</strong></p>
  
  <pre><code>"outputs": {
      "storageKey": {
          "type": "string",
          "value": "[listKeys(resourceid(resourceGroup().name, 'Microsoft.Storage/storageAccounts', parameters('storageAccountName')), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]"
      }
  }
  </code></pre>
  
  <p><strong>Root template</strong></p>
  
  <pre><code>{
      "apiVersion": "[variables('apiVersion')]",
      "type": "Microsoft.Resources/deployments",
      "name": "[concat(resourceGroup().Name, '-', variables('tdfConfiguration')[copyIndex()]['roleName'], '-storage')]",
      "copy": {
          "name": "storageCopy",
          "count": "[length(variables('tdfConfiguration'))]"
      },
      "properties": {
          "mode": "Incremental",
          "templateLink": {
              "uri": "[variables('storageAccountTemplateUri')]",
              "contentVersion": "1.0.0.0"
          },
          "parameters": {
              "storageAccountName": { "value": "[variables('tdfConfiguration')[copyIndex()]['componentName']]" },
              "storageAccountLocation": { "value": "[resourceGroup().location]" },
              "storageAccountType": { "value": "[variables('storageAccountType')]" }
          }
      }
  },
  
  {
      "apiVersion": "[variables('apiVersion')]",
      "type": "Microsoft.Resources/deployments",
      "name": "[concat(resourceGroup().Name, '-', variables('tdfConfiguration')[copyIndex()]['roleName'], '-website')]",
      "copy": {
          "name": "webSiteCopy",
          "count": "[length(variables('tdfConfiguration'))]"
      },
      "dependsOn": [
          "[concat('Microsoft.Resources/deployments/', resourceGroup().Name, '-', variables('tdfConfiguration')[copyIndex()]['roleName'], '-serviceplan')]",
          "[concat('Microsoft.Resources/deployments/', resourceGroup().Name, '-', variables('tdfConfiguration')[copyIndex()]['roleName'], '-storage')]"
      ],
      "properties": {
          "mode": "Incremental",
          "templateLink": {
              "uri": "[variables('webSiteTemplateUri')]",
              "contentVersion": "1.0.0.0"
          },
          "parameters": {
              "azureWebJobsStorageAccountKey": { "value": "[reference(concat(resourceGroup().Name, '-', variables('tdfConfiguration')[copyIndex()]['roleName'], '-storage')).outputs.storageKey.value]" }
  
          }
      }
  },
  </code></pre>
  
  <p>I'm worried that passing that around as a string may expose it in some deployment logs. However if I switch it to a securestring output parameter <a href="https://stackoverflow.com/questions/54435900/how-to-use-secureobject-or-securestring-returned-from-a-linked-arm-template">I can no longer access the value</a>. So it seems like I need to listkeys in the root template, but if I change my website parameters to </p>
  
  <pre><code>  "azureWebJobsStorageAccountKey": { "value": "[listKeys(resourceId('Microsoft.Storage/storageAccounts',variables('tdfConfiguration')[copyIndex()]['componentName']), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]" }
  </code></pre>
  
  <p>it fails because even though the storage account is listed as a dependsOn, it attempts to resolve this value immediately without waiting for the storage account to be deployed. Any ideas?</p>