Key Vault references in App Service in Azure - Mini Project: Build & Apply

Using Key Vault References in Azure App Service

📖 Scenario: You are building a secure web application hosted on Azure App Service. To keep sensitive information safe, you want to use Azure Key Vault to store secrets like database connection strings. Your goal is to configure your App Service to reference these secrets directly from Key Vault without exposing them in your app code.

🎯 Goal: Configure an Azure App Service to use Key Vault references for accessing secrets securely. You will create a Key Vault with secrets, set up an App Service, and link the secrets using Key Vault references in the App Service configuration.

📋 What You'll Learn

Create an Azure Key Vault named myKeyVault with two secrets: DbConnectionString and ApiKey with exact values.

Create an Azure App Service named myAppService.

Add a configuration setting in myAppService that references the DbConnectionString secret from myKeyVault using Key Vault references syntax.

Add a configuration setting in myAppService that references the ApiKey secret from myKeyVault using Key Vault references syntax.

💡 Why This Matters

🌍 Real World

Many cloud applications need to keep secrets like passwords and API keys safe. Using Azure Key Vault references in App Service is a common way to do this securely without hardcoding secrets.

💼 Career

Cloud engineers and developers often configure secure secret management for applications. Knowing how to use Key Vault references is essential for secure cloud deployments.

1

Create Azure Key Vault with Secrets

Create an Azure Key Vault named myKeyVault. Add two secrets to it: DbConnectionString with value Server=myserver;Database=mydb;User Id=myuser;Password=mypassword; and ApiKey with value 12345-abcde-67890-fghij.

Azure

# Create Azure Key Vault and add secrets
# Your code here

Hint

Use az keyvault create to create the vault and az keyvault secret set to add secrets.

2

Create Azure App Service

Create an Azure App Service named myAppService in the resource group myResourceGroup and location eastus. Use the az webapp create command.

Azure

az keyvault create --name myKeyVault --resource-group myResourceGroup --location eastus
az keyvault secret set --vault-name myKeyVault --name DbConnectionString --value "Server=myserver;Database=mydb;User Id=myuser;Password=mypassword;"
az keyvault secret set --vault-name myKeyVault --name ApiKey --value "12345-abcde-67890-fghij"
# Create Azure App Service named myAppService
# Your code here

Hint

Use az webapp create with the name myAppService and specify the resource group and location. Remember to create an App Service plan first.

3

Add Key Vault Reference for DbConnectionString

Add an application setting to myAppService named DbConnectionString that references the secret DbConnectionString from myKeyVault using the Key Vault reference syntax: @Microsoft.KeyVault(SecretUri=https://myKeyVault.vault.azure.net/secrets/DbConnectionString/).

Azure

az keyvault create --name myKeyVault --resource-group myResourceGroup --location eastus
az keyvault secret set --vault-name myKeyVault --name DbConnectionString --value "Server=myserver;Database=mydb;User Id=myuser;Password=mypassword;"
az keyvault secret set --vault-name myKeyVault --name ApiKey --value "12345-abcde-67890-fghij"
az appservice plan create --name myAppServicePlan --resource-group myResourceGroup --location eastus --sku B1
az webapp create --name myAppService --resource-group myResourceGroup --plan myAppServicePlan --runtime "DOTNET|6.0" --location eastus
# Add app setting DbConnectionString with Key Vault reference
# Your code here

Hint

Use az webapp config appsettings set to add the setting with the Key Vault reference syntax.

4

Add Key Vault Reference for ApiKey

Add an application setting to myAppService named ApiKey that references the secret ApiKey from myKeyVault using the Key Vault reference syntax: @Microsoft.KeyVault(SecretUri=https://myKeyVault.vault.azure.net/secrets/ApiKey/).

Azure

az keyvault create --name myKeyVault --resource-group myResourceGroup --location eastus
az keyvault secret set --vault-name myKeyVault --name DbConnectionString --value "Server=myserver;Database=mydb;User Id=myuser;Password=mypassword;"
az keyvault secret set --vault-name myKeyVault --name ApiKey --value "12345-abcde-67890-fghij"
az appservice plan create --name myAppServicePlan --resource-group myResourceGroup --location eastus --sku B1
az webapp create --name myAppService --resource-group myResourceGroup --plan myAppServicePlan --runtime "DOTNET|6.0" --location eastus
az webapp config appsettings set --name myAppService --resource-group myResourceGroup --settings DbConnectionString="@Microsoft.KeyVault(SecretUri=https://myKeyVault.vault.azure.net/secrets/DbConnectionString/)"
# Add app setting ApiKey with Key Vault reference
# Your code here

Hint

Use az webapp config appsettings set again to add the ApiKey setting with the Key Vault reference syntax.

Practice

1. What is the main purpose of using Key Vault references in an Azure App Service?

easy

A. To speed up the app's startup time

B. To enable automatic scaling of the app service

C. To securely access secrets without storing them directly in app settings

D. To create backups of the app's configuration

Solution

1. Step 1: Understand Key Vault references purpose

   Key Vault references allow apps to use secrets securely by referencing them instead of storing secrets directly in app settings.

2. Step 2: Identify the correct purpose

   The other options describe unrelated features like speeding up startup time, enabling automatic scaling, or creating backups, which are not the purpose of Key Vault references.

3. Final Answer:

   To securely access secrets without storing them directly in app settings -> Option C

4. Quick Check:

   Key Vault references = secure secret access [OK]

Hint: Key Vault references keep secrets out of app settings [OK]

Common Mistakes:

• Thinking Key Vault references improve app speed
• Confusing Key Vault references with scaling features
• Assuming Key Vault references create backups

2. Which syntax correctly references a Key Vault secret named DbPassword in an Azure App Service application setting?

easy

A. @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/DbPassword/)

B. KeyVaultSecret:DbPassword

C. vault://myvault/DbPassword

D. SecretRef(DbPassword)

Solution

1. Step 1: Recall correct Key Vault reference syntax

   The correct syntax uses @Microsoft.KeyVault(SecretUri=...) with the full secret URI.

2. Step 2: Compare options

   The other options do not follow the required Azure App Service Key Vault reference format.

3. Final Answer:

   @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/DbPassword/) -> Option A

4. Quick Check:

   Correct syntax starts with @Microsoft.KeyVault(SecretUri=...) [OK]

Hint: Use @Microsoft.KeyVault(SecretUri=...) for secret references [OK]

Common Mistakes:

• Omitting the full secret URI
• Using incorrect prefixes like KeyVaultSecret or vault://
• Not including parentheses and SecretUri keyword

3. Given this app setting in Azure App Service:
MySecret = @Microsoft.KeyVault(SecretUri=https://vault123.vault.azure.net/secrets/ApiKey/)
What happens when the app tries to read MySecret if the managed identity lacks access to the Key Vault?

medium

A. The app setting returns an empty string

B. The app fails to start or throws an authentication error

C. The app receives the secret value successfully

D. The app uses a cached secret value from previous runs

Solution

1. Step 1: Understand managed identity role

   The app's managed identity must have access permissions to read secrets from Key Vault.

2. Step 2: Effect of missing access

   If access is missing, the app cannot retrieve the secret and will fail with an authentication or authorization error.

3. Final Answer:

   The app fails to start or throws an authentication error -> Option B

4. Quick Check:

   No access = authentication error [OK]

Hint: Managed identity needs Key Vault access to avoid errors [OK]

Common Mistakes:

• Assuming the app gets empty string instead of error
• Thinking the app uses cached secrets automatically
• Believing the app can read secrets without permissions

4. You configured a Key Vault reference in your App Service but the app still shows the literal reference string instead of the secret value. What is the most likely cause?

medium

A. Managed identity is not enabled on the App Service

B. The secret name in the reference is misspelled

C. The App Service is in a different region than the Key Vault

D. The app setting key is not named correctly

Solution

1. Step 1: Check managed identity status

   Key Vault references require the App Service to have a managed identity enabled to authenticate to Key Vault.

2. Step 2: Understand effect of missing managed identity

   If managed identity is not enabled, the app cannot resolve the reference and shows the literal string.

3. Final Answer:

   Managed identity is not enabled on the App Service -> Option A

4. Quick Check:

   No managed identity = literal reference shown [OK]

Hint: Enable managed identity to resolve Key Vault references [OK]

Common Mistakes:

• Assuming region mismatch causes this issue
• Thinking misspelled secret name shows literal string
• Believing app setting key name affects reference resolution

5. You want to securely use multiple secrets from Azure Key Vault in your App Service. Which combination of steps ensures best practice for this setup?

hard

A. Use connection strings in app settings without managed identity, and manually update secrets

B. Store secrets directly in app settings, enable managed identity, and use environment variables

C. Enable managed identity, grant 'List' permission only, and use custom code to fetch secrets

D. Enable managed identity on App Service, grant it 'Get' secret permission in Key Vault, use @Microsoft.KeyVault references in app settings

Solution

1. Step 1: Enable managed identity and grant 'Get' permission

   The managed identity must be enabled and granted 'Get' permission on secrets in Key Vault to allow secure access.

2. Step 2: Use Key Vault references in app settings

   Use the special syntax @Microsoft.KeyVault(SecretUri=...) in app settings to link secrets securely without storing them directly.

3. Final Answer:

   Enable managed identity on App Service, grant it 'Get' secret permission in Key Vault, use @Microsoft.KeyVault references in app settings -> Option D

4. Quick Check:

   Managed identity + Get permission + Key Vault references = best practice [OK]

Hint: Managed identity + Get permission + Key Vault references = secure setup [OK]

Common Mistakes:

• Storing secrets directly in app settings
• Granting only 'List' permission without 'Get'
• Not enabling managed identity on App Service