Box 1: "Microsoft.Resources/deployments"
Reference a secret with dynamic ID. You need to reference a key vault secret that varies based on the current deployment.
Example:
"resources": [
{
"apiVersion": "2018-05-01",
"name": "dynamicSecret",
"type": "Microsoft.Resources/deployments",
"properties": {
"mode": "Incremental",
"templateLink": {
Box 2: "templateLink"
In your parent template, you add the linked template and pass in a parameter that contains the dynamically generated resource ID.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-keyvault-parameter