Welcome to the Lounge

Jörgen Andersson wrote:

The good part, and this is where most systems fail, is that anyone can understand it.

Quote:

To securely access the Key Vault from your applications without exposing the secrets in config files, you can leverage Azure Managed Service Identity (MSI) feature.

Managed Service Identity (MSI) is a feature of Azure Active Directory that provides Azure services with an automatically managed identity in Azure AD. With MSI, Azure services can authenticate with other Azure services that support Azure AD authentication, without requiring you to manage any secrets or credentials.

The process for accessing the Key Vault using MSI can be summarized in the following steps:

Enable the MSI feature for your Azure App Service/Web App: Enable the system assigned identity for your Web App by turning it on in the Identity blade of your Web App.

Add access policy to Key Vault: Once MSI is enabled, navigate to your Key Vault, select the Access policies blade, and add the necessary permissions to allow your Web App to access the Key Vault.

Modify your code to use MSI to authenticate with the Key Vault: In your code, you can use the Azure.Identity NuGet package to authenticate with the Key Vault using the MSI endpoint. Here's some sample code that demonstrates how to access a secret in a Key Vault using MSI:

var credential = new DefaultAzureCredential();
var client = new SecretClient(new Uri("https://{keyvault-name}.vault.azure.net/"), credential);
KeyVaultSecret secret = await client.GetSecretAsync("secret-name");
string secretValue = secret.Value;