How to use the @pulumi/azure.keyvault function in @pulumi/azure

"StorageBlobUrl": textBlob.url,
    },

    // A SQL connection string, still without secrets in it
    connectionStrings: [{
        name: "db",
        value: connectionString,
        type: "SQLAzure",
    }],
});

// Work around a preview issue https://github.com/pulumi/pulumi-azure/issues/192
const principalId = app.identity.apply(id => id.principalId || "11111111-1111-1111-1111-111111111111");

// Grant App Service access to KV secrets
const policy = new azure.keyvault.AccessPolicy("app-policy", {
    keyVaultId: vault.id,
    tenantId: tenantId,
    objectId: principalId,
    secretPermissions: ["get"],
});

// Make the App Service the admin of the SQL Server (double check if you want a more fine-grained security model in your real app)
const sqlAdmin = new azure.sql.ActiveDirectoryAdministrator("adadmin", {
    resourceGroupName: resourceGroup.name,
    tenantId: tenantId,
    objectId: principalId,
    login: "adadmin",
    serverName: sqlServer.name,
});

// Grant access from App Service to the container in the storage

// ASP.NET deployment package
const blob = new azure.storage.ZipBlob("zip", {
    storageAccountName: storageAccount.name,
    storageContainerName: storageContainer.name,
    type: "block",

    content: new pulumi.asset.FileArchive("./webapp/bin/Debug/netcoreapp2.2/publish"),
});

const clientConfig = azure.core.getClientConfig({ async: true });
const tenantId = clientConfig.then(config => config.tenantId);
const currentPrincipal = clientConfig.then(config => config.objectId);

// Key Vault to store secrets (e.g. Blob URL with SAS)
const vault = new azure.keyvault.KeyVault("vault", {
    resourceGroupName: resourceGroup.name,
    skuName: "standard",
    tenantId: tenantId,
    accessPolicies: [{
        tenantId,
        // The current principal has to be granted permissions to Key Vault so that it can actually add and then remove
        // secrets to/from the Key Vault. Otherwise, 'pulumi up' and 'pulumi destroy' operations will fail.
        objectId: currentPrincipal,
        secretPermissions: ["delete", "get", "list", "set"],
    }],
});

// Put the URL of the zip Blob to KV
const secret = new azure.keyvault.Secret("deployment-zip", {
    keyVaultId: vault.id,
    value: azure.storage.signedBlobReadUrl(blob, storageAccount),