Interpolating sensitive values in jenkins pipeline

Using Jenkins Ask a question
1

Jenkins setup:

Jenkins: 2.440.1
OS: Windows Server 2019 - 10.0
Java: 17.0.7 - Oracle Corporation (Java HotSpot™ 64-Bit Server VM)

authentication-tokens:1.53.v1c90fd9191a_b_
azure-cli:0.9
azure-credentials:312.v0f3973cd1e59
azure-sdk:132.v62b_48eb_6f32f
blueocean:1.27.11
cloudbees-bitbucket-branch-source:877.vb_b_d5243f6794
cloudbees-folder:6.848.ve3b_fd7839a_81
command-launcher:107.v773860566e2e
credentials:1319.v7eb_51b_3a_c97b_
credentials-binding:657.v2b_19db_7d6e6d
git:5.2.1
git-client:4.6.0
jdk-tool:73.vddf737284550
jenkins-design-language:1.27.11
pipeline-build-step:505.v5f0844d8d126
terraform:1.0.10

Scenario: Fetching the subnet id from azure and whitelisting it to a storage account.
Note: the Variable SUBNET_ID contains a sensitive value which is generated only after executing the first command. I would like to pass this value to the second command using the variable.

The issue faced is that the second bat command does not substitute the value of the variable SUBNET_ID. The jenkins file as follows:
‘’’
def workspacePath = “C:\Jenkins\{JOB_NAME}" pipeline { agent { node { label '' customWorkspace workspacePath } } environment { AZURE_CREDS = credentials('az_sp') VNET_RG = 'vnetrg' VNET_NAME = 'vnetname' SUBNET_NAME = 'default' STRG_ACC_RG = 'strgrg' STRG_ACC_NAME = 'strgname' } stages { stage('Print Job Name') { steps { echo "Job Name: {JOB_NAME}”
}
}
stage(‘Azure Login’) {
steps {
bat ‘az login --service-principal -u %AZURE_CREDS_CLIENT_ID% -p %AZURE_CREDS_CLIENT_SECRET% --tenant %AZURE_CREDS_TENANT_ID%’
}
}

stage('Execute Azure CLI Commands') {
        steps {
            script {
         SUBNET_ID=bat(returnStdout:true, script: 'az network vnet subnet show --resource-group %VNET_RG% --vnet-name %VNET_NAME% --name %SUBNET_NAME% --query id --output tsv').trim()

                   // Add subnet to storage account network rules
                    bat 'az storage account network-rule add -g %STRG_ACC_RG% --account-name %STRG_ACC_NAME% --subnet %SUBNET_ID% --bypass AzureServices'
                }
            }                    
    }

}
}
‘’’

2

SUBNET_ID is just a variable in groovy. Those are not automatically available as env variables.
You can try
bat "az storage account network-rule add -g %STRG_ACC_RG% --account-name %STRG_ACC_NAME% --subnet $SUBNET_ID --bypass AzureServices"

Or wrap it in a withEnv block

withEnv(["SUBNET_ID=$SUBNET_ID"]) {
  bat 'az storage account network-rule add -g %STRG_ACC_RG% --account-name %STRG_ACC_NAME% --subnet %SUBNET_ID% --bypass AzureServices'
}
3

I did try this in the past, but the issue faced is that instead of replacing the subnetid, the variable replaces the entire command in place and not the value. Error from console log:
‘’’
C:\Jenkins\job>az storage account network-rule add -g strrg --account-name strname --subnet C:\Jenkins\job network vnet subnet show --resource-group vnetrg --vnet-name vnetname --name default --query id --output tsv 1>az
ERROR: unrecognized arguments: network vnet subnet show --name default

‘’’