Use named values in round-trip logger overrides

Author: Copilot

tests/integration/all-resource-types/bicep/source-apim.bicep

@@ -437,6 +437,38 @@ resource nvKeyVault 'Microsoft.ApiManagement/service/namedValues@2025-09-01-prev
   }
 }
 
+resource nvAppInsightsKey 'Microsoft.ApiManagement/service/namedValues@2025-09-01-preview' = {
+  parent: apim
+  name: 'src-nv-appinsights-key'
+  properties: {
+    displayName: 'src-nv-appinsights-key'
+    value: appInsights.properties.InstrumentationKey
+    secret: true
+    tags: ['all-resources', 'logger', 'appinsights']
+  }
+}
+
+resource nvEventHubName 'Microsoft.ApiManagement/service/namedValues@2025-09-01-preview' = {
+  parent: apim
+  name: 'src-nv-eventhub-name'
+  properties: {
+    displayName: 'src-nv-eventhub-name'
+    value: eventHub.name
+    tags: ['all-resources', 'logger', 'eventhub']
+  }
+}
+
+resource nvEventHubConnectionString 'Microsoft.ApiManagement/service/namedValues@2025-09-01-preview' = {
+  parent: apim
+  name: 'src-nv-eventhub-connection-string'
+  properties: {
+    displayName: 'src-nv-eventhub-connection-string'
+    value: eventHubAuthRule.listKeys().primaryConnectionString
+    secret: true
+    tags: ['all-resources', 'logger', 'eventhub']
+  }
+}
+
 // --- Tags ---
 resource tagEnv 'Microsoft.ApiManagement/service/tags@2025-09-01-preview' = {
   parent: apim
@@ -562,25 +594,30 @@ resource backendPool 'Microsoft.ApiManagement/service/backends@2025-09-01-previe
 resource loggerAppInsights 'Microsoft.ApiManagement/service/loggers@2025-09-01-preview' = {
   parent: apim
   name: 'src-logger-appinsights'
+  dependsOn: [nvAppInsightsKey]
   properties: {
     loggerType: 'applicationInsights'
     description: 'Application Insights logger for BVT'
     resourceId: appInsights.id
     credentials: {
-      instrumentationKey: appInsights.properties.InstrumentationKey
+      instrumentationKey: '{{src-nv-appinsights-key}}'
     }
   }
 }
 
 resource loggerEventHub 'Microsoft.ApiManagement/service/loggers@2025-09-01-preview' = {
   parent: apim
   name: 'src-logger-eventhub'
+  dependsOn: [
+    nvEventHubName
+    nvEventHubConnectionString
+  ]
   properties: {
     loggerType: 'azureEventHub'
     description: 'Event Hub logger for BVT'
     credentials: {
-      name: eventHub.name
-      connectionString: eventHubAuthRule.listKeys().primaryConnectionString
+      name: '{{src-nv-eventhub-name}}'
+      connectionString: '{{src-nv-eventhub-connection-string}}'
     }
   }
 }

tests/integration/all-resource-types/expected-structure.json

@@ -18,7 +18,7 @@
   },
   "directories": {
     "namedValues": {
-      "minCount": 3,
+      "minCount": 6,
       "expected": [
         {
           "name": "src-nv-plain",
@@ -56,6 +56,42 @@
             }
           },
           "notes": "KeyVault reference type"
+        },
+        {
+          "name": "src-nv-appinsights-key",
+          "files": ["namedValueInformation.json"],
+          "spotChecks": {
+            "namedValueInformation.json": {
+              "properties.displayName": "src-nv-appinsights-key",
+              "properties.secret": true,
+              "properties.tags": ["all-resources", "logger", "appinsights"]
+            }
+          },
+          "notes": "Logger Application Insights instrumentation key stored as a secret named value"
+        },
+        {
+          "name": "src-nv-eventhub-name",
+          "files": ["namedValueInformation.json"],
+          "spotChecks": {
+            "namedValueInformation.json": {
+              "properties.displayName": "src-nv-eventhub-name",
+              "properties.value": "src-apim-logs",
+              "properties.secret": false,
+              "properties.tags": ["all-resources", "logger", "eventhub"]
+            }
+          }
+        },
+        {
+          "name": "src-nv-eventhub-connection-string",
+          "files": ["namedValueInformation.json"],
+          "spotChecks": {
+            "namedValueInformation.json": {
+              "properties.displayName": "src-nv-eventhub-connection-string",
+              "properties.secret": true,
+              "properties.tags": ["all-resources", "logger", "eventhub"]
+            }
+          },
+          "notes": "Logger Event Hub connection string stored as a secret named value"
         }
       ]
     },
@@ -184,21 +220,22 @@
           "spotChecks": {
             "loggerInformation.json": {
               "properties.loggerType": "applicationInsights",
-              "properties.credentials.instrumentationKey": "exists"
+              "properties.credentials.instrumentationKey": "{{src-nv-appinsights-key}}"
             }
           },
-          "notes": "Instrumentationkey should be redacted"
+          "notes": "Instrumentation key should be referenced via NamedValue"
         },
         {
           "name": "src-logger-eventhub",
           "files": ["loggerInformation.json"],
           "spotChecks": {
             "loggerInformation.json": {
               "properties.loggerType": "azureEventHub",
-              "properties.credentials.name": "src-apim-logs"
+              "properties.credentials.name": "{{src-nv-eventhub-name}}",
+              "properties.credentials.connectionString": "{{src-nv-eventhub-connection-string}}"
             }
           },
-          "notes": "Connection string should be redacted"
+          "notes": "Event Hub logger credentials should be referenced via NamedValues"
         }
       ]
     },

tests/integration/all-resource-types/phases/run-phase4-create-overrides.ps1

@@ -104,16 +104,16 @@ namedValues:
   src-nv-keyvault:
     keyVault:
       secretIdentifier: "${targetKvUri}secrets/tgt-secret-value"
+  src-nv-appinsights-key:
+    value: "$targetAiKey"
+  src-nv-eventhub-name:
+    value: "tgt-eh-logs"
+  src-nv-eventhub-connection-string:
+    value: "$targetEhConnStr"
 
 loggers:
   src-logger-appinsights:
     resourceId: "$targetAiResourceId"
-    credentials:
-      instrumentationKey: "$targetAiKey"
-  src-logger-eventhub:
-    credentials:
-      name: "tgt-eh-logs"
-      connectionString: "$targetEhConnStr"
 "@
 
 $overrideYaml | Set-Content -Path $overrideFile -Encoding utf8