How to manage ~/.azd/vaults/xyz.json ?

[dluc]

azd is storing secrets in base64 format under ~/.azd/vaults/{some id}.json.

azd deploy is then copying these values under my Azure ContainerApp Secrets, for example:

How do I edit with azd the secrets stored locally under ~/.azd/vaults ? azd env set-secret doesn't allow to write to the local vault, only to Azure KV.

Currently I find the right vault by inspecting .azure/{env id}/config.json and manually edit the corersponding file under ~/.azd/vaults/, dealing with base64 encoding manually. However, this manual process is error prone and cannot be automated in CD pipelines.

Example: .azure/myenv/config.json:

{
  "infra": {
    "parameters": {
      "accesskey1": "vault://11073122-0831-4cba-9ed8-17ec4360fde8/aaa665e4-ac99-46c7-acd8-a36d44e7bc32",
      "accesskey2": "vault://11073122-0831-4cba-9ed8-17ec4360fde8/26b3d840-c3ff-491a-bf38-cf893bcc6714",
      "qdrantstorage_Key": "vault://11073122-0831-4cba-9ed8-17ec4360fde8/cd946f29-c6b9-4003-9701-f164de0926eb"
    }
  },
  "vault": "11073122-0831-4cba-9ed8-17ec4360fde8"
}

Example: ~/.azd/vaults/11073122-0831-4cba-9ed8-17ec4360fde8.json:

{
  "26b3d840-c3ff-491a-bf38-cf893bcc6714": "bmljZSB0cnksIHRoaXMgYWluJ3Qgbm8gcHdk",
  "aaa665e4-ac99-46c7-acd8-a36d44e7bc32": "YmFzZTY0IGlzIG5pY2UsIGlzbid0IGl0Pw==",
  "cd946f29-c6b9-4003-9701-f164de0926eb": "c2VlIHlvdSBhdCBCdWlsZCE="
}