After some extra research, I've come up to a working solution, although it is not what I expected, as I intended to retrieve the whole secret address as a property of the certificate.
If I concatenate the keyvault address with the certificate data like this:
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
name: keyVaultName
}
resource apiManagementName_resource = {
[... some other settings ...]
hostnameConfigurations: [
{
type: 'Proxy'
hostName: 'my-url.my-domain.com'
keyVaultId: '${keyVault.properties.vaultUri}secrets/${certificateName}'
certificateSource: 'KeyVault'
defaultSslBinding: true
negotiateClientCertificate: false
}
}
Then the certificate is attached properly to the custom domain field in the api management.
Also as it does not include the version, it is supposed to be taking the last one so if renovated, it should keep working.