Explanation/Reference:
Invoke-Sqlcmd runs a script containing statements supported by the SQL Server SQLCMD utility.
The following example creates a SQL Server credential for the Database Engine to use when accessing the Azure Key Vault using the SQL Server Connector for Microsoft Azure Key Vault.
CREATE CREDENTIAL Azure_EKM_TDE_cred
WITH IDENTITY = 'ContosoKeyVault',
SECRET = 'EF5C8E094D2A4A769998D93440D8115DSECRET_DBEngine'
FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov ;
References: https://docs.microsoft.com/en-us/sql/t-sql/statements/create-credential-transact-sql