Azure Key Vault is a cloud service that provides secure storage to store your keys, secrets, and other sensitive configuration data for your application. Most of the time these keys are stored in the application configuration file such as appsetting.json, web.config in a .NET application. You can have multiple versions of the same key securely stored here and you can use the same vault for the secrets used in different apps. Storing Application secrets in Azure Key Vault
Go to the Azure portal and create a new Key Vault by clicking on Create a resource tile.
Create resource
Key Vault
Create key vault
Once you have successfully provisioned your Key Vault Create a secret by going to the Secrets tab.
Create secret
Once you have created the secret you will have the Secret Identifier which will be used for retrieving secrets for a function app later in this article.
Authorize your application to use Key vault secret
Next, you need to authorize the application to use the required secret.
There are mainly two ways to authorize applications in Key Vault secrets.
Using Azure Active Directory App
Using Managed Identity
1. Using Azure Active Directory App
This method is mainly used when you need to access your key vault secrets in addition to Azure resources. (from your local machine)
Here you have to create an Azure Active Directory app. Go to the Portal > Azure Active Directory > App registration blade > New Registration. Register your AAD App with your needed configurations.
AAD App registration
After the registration and copy the Application (Client) ID for a text editor from the Overview page.
AAD App overview
Create a new client secret and copy its Value as well to a text editor. You will need these values to add to the application.json file in your dot net core project
Create Secret
Then you should go to your Key vault > Access policies blade and Add Access policy with your AAD app using your copied Client ID and necessary permissions.
Add Access policy
2. Using Managed Identity
This method is mainly used when you need to access your key vault secrets from Azure resources. (production env such as azure web apps)
To enable identity you should go to your App service > Identity and Turn On the Status and copy the Object(Principal ID).
Managed Identity
Then you should go to your Key vault > Access policies blade and Add Access policy with your Azure resource using copied Principal ID and necessary permissions as in the previous step.
Using Key Vault secrets in your ASP .NET app
Now let's try to retrieve the secret we created in the Azure Key Vault.
First of all, to connect with the Azure key vault you need to install the below NuGet packages. Use the Package manager console in Visual studio to install those.
PM> Install-Package Microsoft.Extensions.Configuration.AzureKeyVault
PM> Install-Package Azure.Identity
PM> Install-Package Azure.Security.KeyVault.Secrets
Now we need to update CreateHostBuilder method in Program.cs to plug Azure Key Vault into ASP .NET Core Application configurations.
public static IHostBuilder CreateHostBuilder(string[] args) =>
Host.CreateDefaultBuilder(args)
.ConfigureAppConfiguration((context, config) =>
{
var settings = config.Build();
if (!context.HostingEnvironment.IsDevelopment())
{
// Production Env
// Connect to Azure Key Vault using the Managed Identity.
var keyVaultEndpoint = settings["AzureKeyVaultEndpoint"];
if (!string.IsNullOrEmpty(keyVaultEndpoint))
{
var azureServiceTokenProvider = new
AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(new
KeyVaultClient.AuthenticationCallback
(azureServiceTokenProvider.KeyVaultTokenCallback));
config.AddAzureKeyVault(
keyVaultEndpoint,
keyVaultClient,
new DefaultKeyVaultSecretManager());
}
}
else
{
// Development Env
// Connect to Azure Key Vault using the Azure AD App
var keyVaultEndpoint = settings["AzureKeyVault:Endpoint"];
var keyVaultClientId = settings["AzureKeyVault:ClientId"];
var keyVaultClientSecret = settings["AzureKeyVault:ClientSecret"];
if (!string.IsNullOrEmpty(keyVaultEndpoint) &&
!string.IsNullOrEmpty(keyVaultClientId) &&
!string.IsNullOrEmpty(keyVaultClientSecret))
{
config.AddAzureKeyVault(
keyVaultEndpoint,
keyVaultClientId,
keyVaultClientSecret,
new DefaultKeyVaultSecretManager());
}
}
})
.ConfigureWebHostDefaults(webBuilder=>
{
webBuilder.UseStartup<Startup>();
});
Here we have two options, For the Development Environment in your local machine, we are using an AAD App to access the token. When the application is deployed to Azure App Service we can use managed Identity to access the Azure Key Vault. For that, we need to update the appsettings.json file as well.
{
"Logging":
{
"LogLevel":
{
"Default": "Information",
"Microsoft": "Warning",
"Microsoft.Hosting.Lifetime": "Information"
}
},
"AllowedHosts": "*",
// Production Env
"AzureKeyVaultEndpoint": "[Your_AzureKeyVaultURI]",
// Development Env
"AzureKeyVault":
{
"Endpoint": "[Your_AzureKeyVaultURI]",
"ClientId": "[Your_AAD_APP_ClientId]",
"ClientSecret": "[Your_AAD_APP_Secret]"
},
"FUNCTION_APP_URL": "[Your_functionapp_url]"
}
Now you have access to the Key vault secrets via application configurations as a separate configuration source. You can access the created secret using constructor injected configuration as below
public TodoDbContext(IConfiguration config)
{
_config=config;
}
protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
if (!optionsBuilder.IsConfigured)
{
optionsBuilder.UseSqlServer(_config["DbConnString"]);
}
base.OnConfiguring(optionsBuilder);
}
private IConfiguration _config;
When you deploy your app to the Azure App Service you can use your App service Configuration to change the Azure key vault URI (Endpoint) using Application settings.
Using Key Vault secrets in your Function app
Since there is no appsetting.json used in function apps we can use Azure function app configuration to access the key vault. You may initialize the properties as below.
private static string _storageKey = Environment.GetEnvironmentVariable(āStorageKeyā, EnvironmentVariableTarget.Process);
Once you have published your function app to Azure go to the Function app instance > Configuration and add an application setting.
Name: StorageKey
Value: @Microsoft.KeyVault(SecretUri=[Your_key_vault_secret_identifier])
You can find the Key vault secret identifier in Secert Version page in your Azure key vault inside Secrets blade.
Key Vault Secret
Finally, you need to add the Identity of the Function App to your Key Vault as we did previously in App service configuration (refer to Image: Managed Identity)
Source: Medium - Dumindu De Silva
The Tech Platform
Comments