deployment templates leak value of _artifactsLocationSasToken

Hello Alexander Clouter,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your deployment templates leak value of _artifactsLocationSasToken.

The issue is not caused by the normal ARM template pattern if your template defines _artifactsLocation as a plain base URI and _artifactsLocationSasToken as a separate securestring. The pattern requires _artifactsLocationSasToken to remain separate from _artifactsLocation, and the token should only be combined with the artifact URI when referencing nested templates, scripts, or other artifacts. - https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/artifacts-location, https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters

You will need to validate that your mainTemplate.json follows the official pattern below:

"parameters": {
  "_artifactsLocation": {
    "type": "string",
    "defaultValue": "[deployment().properties.templateLink.uri]"
  },
  "_artifactsLocationSasToken": {
    "type": "securestring",
    "defaultValue": ""
  }
}

Then reference artifacts only like this:

"variables": {
  "nestedTemplateUri": "[uri(parameters('_artifactsLocation'), concat('nestedtemplates/template.json', parameters('_artifactsLocationSasToken')))]",
  "scriptFileUri": "[uri(parameters('_artifactsLocation'), concat('scripts/install.sh', parameters('_artifactsLocationSasToken')))]"
}

Other things you need to notice:

• Do not manually append the SAS token into _artifactsLocation, and do not pass a signed URI as the _artifactsLocation value. _artifactsLocation must remain the base artifact location only, while _artifactsLocationSasToken must remain the secure token parameter. - https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/artifacts-location
• If the deployment history still shows the SAS token appended to _artifactsLocation after confirming the template is correct, then this is a Microsoft platform-side defect/regression in the Azure Managed Applications / Marketplace artifact deployment pipeline. It cannot be permanently fixed from the customer template. So, open an Azure support case via your portal or use Priority Customer Support - PCS: https://learn.microsoft.com/en-us/azure/azure-portal/supportability/priority-community-support and request escalation to Azure Managed Applications / Marketplace engineering, providing the managed application resource ID, managed resource group name, offer/plan/publisher IDs, deployment names, UTC timestamp, and affected correlation IDs. Microsoft documents that deployment history and correlation IDs are used to trace deployment operations for support investigation. - https://docs.azure.cn/en-us/azure-resource-manager/templates/deployment-history
• Thirdly, immediate mitigation is to treat any exposed SAS URL as compromised for its validity period because a SAS URI is a bearer-access URL; anyone who obtains it can access the referenced artifact while it remains valid. Also, do not place secrets, passwords, private keys, or sensitive publisher IP directly inside ARM templates, nested templates, scripts, or deployment artifacts. Because, that SAS-protected templates should not contain sensitive data such as passwords. - https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/secure-template-with-sas-token
• For secrets, use managed identities, Key Vault, secure parameters, and runtime retrieval instead of embedding confidential values in Marketplace or Service Catalog artifacts. Also avoid outputting secrets because deployment outputs are stored in deployment history.

In summary, if your template follows the documented pattern and Azure still records the SAS token inside _artifactsLocation, the issue is not solved by changing the template. But to escalate it as a Microsoft Managed Applications / Marketplace service defect, while immediately removing secrets and sensitive IP from deployment artifacts and using secure runtime secret retrieval instead.

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.