How to Store Secret in Azure Key Vault Securely

To store a secret in Azure Key Vault, use the az keyvault secret set command with your vault name and secret value. This securely saves your secret so your applications can access it safely without exposing sensitive data.

Syntax

The basic command to store a secret in Azure Key Vault is:

az keyvault secret set --vault-name <VaultName> --name <SecretName> --value <SecretValue>

Here:

• --vault-name is the name of your Azure Key Vault.
• --name is the name you want to give your secret.
• --value is the secret data you want to store securely.

bash

az keyvault secret set --vault-name MyVault --name MySecret --value "MySecretValue123"

Example

This example shows how to store a password as a secret in Azure Key Vault named MyVault. It uses Azure CLI to set the secret called DbPassword with the value SuperSecret123!.

bash

az keyvault secret set --vault-name MyVault --name DbPassword --value "SuperSecret123!"

Output

{"id":"https://MyVault.vault.azure.net/secrets/DbPassword/","attributes":{"enabled":true,"created":<timestamp>,"updated":<timestamp>},"value":null}

Common Pitfalls

Common mistakes when storing secrets include:

• Using incorrect vault name or secret name, causing command failure.
• Exposing secret values in scripts or logs instead of using environment variables.
• Not setting proper access policies on the Key Vault, so your app cannot read the secret.

Always verify your vault exists and your user has permission to add secrets.

bash

## Wrong: Exposing secret in logs
az keyvault secret set --vault-name MyVault --name ApiKey --value "12345"

## Right: Use environment variable to avoid exposing secret
export SECRET_VALUE="12345"
az keyvault secret set --vault-name MyVault --name ApiKey --value "$SECRET_VALUE"

Quick Reference

Parameter	Description
--vault-name	Name of your Azure Key Vault
--name	Name of the secret to store
--value	The secret value to save securely
az keyvault secret set	Command to store a secret
az keyvault secret show	Command to retrieve a secret

Key Takeaways

Use the Azure CLI command 'az keyvault secret set' with vault name, secret name, and value to store secrets.

Keep secret values out of scripts and logs by using environment variables or secure input methods.

Ensure your Azure Key Vault access policies allow your user or app to add and read secrets.

Verify the vault name and secret name are correct to avoid errors.

Use 'az keyvault secret show' to retrieve stored secrets safely.