[Feature request] Secure secrets retrieval in .env file

[sinedied]

• Make sure you've installed the latest version using instructions in the wiki

Output from azd version
azd version 1.8.0 (commit 8246323)

Describe the issue

.env files are often used during development to test/debug an app locally, while connecting to cloud resources. AZD generates such .env files in .azure folder, and allows to retrieve these values with azd env get-values.

The problem is that currently the only way to retrieve secrets such as connection strings or API keys in that .env file is to expose them as output in the Bicep templates, an unsecure practice as these secrets then gets exposed in Azure deployments.

A workaround to that issue is to use Key Vault to store the secrets, but in that case to get these secrets added into the .env for local testing, it complicates things a lot for the users:

• You have to install AZ CLI in addition to AZD (~1 Go)
• You have to log in to AZ CLI in addition to AZD
• You have to create a script that list the the secrets in KV, retrieve them 1 by 1 and add them to .env file. And double that if you need to support both Mac/Linux and Windows

Given that AZD aims to be the main CLI tool for developers, it would make sense to integrate a feature to automatically retrieve secrets from a KV and include them in the generated .env file.

Note: I'm aware that Managed Identity is the best way to avoid handling secrets, but not all services and tools supports them. For example, Azure CosmosDB for MongoDB vCore only supports connection strings, and Azure Database Vs Code extension can only connect to DB using a connection strings.

[weikanglim]

Inspirationally, I would love if we could tell a story like this for users that are used to environment variables:

export OPENAI_KEY='<secret>' 
azd provision

Or:

# this works just like before,
# the variable is just stored securely for repeatability and automated CI setup 
azd env set --secret OPENAI_KEY='<secret>'
azd provision