Why secrets management matters in Azure - Why It Works

Introduction

Secrets like passwords and keys keep your apps safe. Managing them properly stops bad people from stealing or misusing them.

When you need to store database passwords securely for your app.

When your app uses API keys to connect to other services.

When you want to avoid putting sensitive info directly in your code.

When multiple team members need access to secrets without sharing files.

When you want to automatically update secrets without downtime.

Commands

This command creates a new Azure Key Vault named myKeyVault123 in the eastus region. Key Vault is where you store secrets safely.

Terminal

az keyvault create --name myKeyVault123 --resource-group myResourceGroup --location eastus

Expected Output

{

  "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.KeyVault/vaults/myKeyVault123",

  "location": "eastus",

  "name": "myKeyVault123",

  "properties": {

    "sku": {

      "family": "A",

      "name": "standard"

    },

    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

  },

  "resourceGroup": "myResourceGroup",

  "type": "Microsoft.KeyVault/vaults"

}

→

--name - Sets the name of the Key Vault

→

--resource-group - Specifies the resource group to use

→

--location - Sets the Azure region for the Key Vault

This command saves a secret named DbPassword with the value MyS3cretPass! into the Key Vault. This keeps the password safe and separate from your code.

Terminal

az keyvault secret set --vault-name myKeyVault123 --name DbPassword --value "MyS3cretPass!"

Expected Output

{

  "id": "https://myKeyVault123.vault.azure.net/secrets/DbPassword/xxxxxxxxxxxx",

  "attributes": {

    "enabled": true,

    "created": 1680000000,

    "updated": 1680000000

  },

  "contentType": null,

  "tags": null

}

→

--vault-name - Specifies which Key Vault to use

→

--name - Names the secret

→

--value - Sets the secret's value

This command retrieves the secret named DbPassword from the Key Vault so you can use it safely in your app or scripts.

Terminal

az keyvault secret show --vault-name myKeyVault123 --name DbPassword

Expected Output

{

  "value": "MyS3cretPass!",

  "id": "https://myKeyVault123.vault.azure.net/secrets/DbPassword/xxxxxxxxxxxx",

  "attributes": {

    "enabled": true,

    "created": 1680000000,

    "updated": 1680000000

  }

}

→

--vault-name - Specifies which Key Vault to use

→

--name - Names the secret to retrieve

Key Concept

If you remember nothing else from this pattern, remember: storing secrets outside your code in a secure vault protects your apps from leaks and hacks.

Common Mistakes

Putting passwords or keys directly in code files.

This exposes secrets if code is shared or pushed to public places.

Use Azure Key Vault to store secrets and retrieve them securely at runtime.

Not setting proper access permissions on the Key Vault.

Anyone with access can read or change your secrets, risking security.

Configure access policies to allow only trusted users or apps to access secrets.

Hardcoding secret values in deployment scripts.

This defeats the purpose of secret management and risks exposure.

Use commands or environment variables to fetch secrets from Key Vault during deployment.

Summary

Create an Azure Key Vault to store secrets securely.

Add secrets like passwords or keys to the Key Vault instead of code.

Retrieve secrets from the Key Vault when your app or scripts need them.