nested-deployment-scoping.json

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vaultName": {
            "type": "string",
            "defaultValue": "scratchVault"
        },
        "secretName": {
            "type": "string",
            "defaultValue": "adminPassword"
        },
        "vaultResourceGroupName": {
            "type": "string",
            "defaultValue": "VaultsGroup"
        }
    },
    "resources": [
        {
            "apiVersion": "2015-01-01",
            "name": "fetchSecret",
            "type": "Microsoft.Resources/deployments",
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {
                        "secretValue": {
                            "type": "securestring"
                        }
                    },
                    "resources": [],
                    "outputs": {
                        "secretValueOutput": {
                            "type": "secureString",
                            "value": "[parameters('secretValue')]"
                        }
                    }
                },
                "parameters": {
                    "secretValue": {
                        "reference": {
                            "keyVault": {
                                "id": "[resourceId(subscription().subscriptionId,  parameters('vaultResourceGroupName'), 'Microsoft.KeyVault/vaults', parameters('vaultName'))]"
                            },
                            "secretName": "[parameters('secretName')]"
                        }
                    }
                }
            }
        }
    ],
    "outputs": {}
}