Azure - Key Vault

         

Scenario: Use Azure Key vault to store secrets

Solution:

Per Azure docs:

Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys.

1. Azure -> Azure Active Directory -> App registrations [left pane]->New registration
1. Name = keyvault-myapp
2. Who can use this application or access this API?  = Accounts in this organizational directory only (Default Directory only - Single tenant)
3. Register
2. On Success, Application ID (Client ID) would be displayed. Copy this for further use.
3. Certificates & secrets -> New Client Secret 
1. Description = client secret
2.  Value = Copy this for further use.
4. New resource -> Key Vault
1. Resource group = Your resource group
2. Key vault name = mykeyvault
3. Region = region
4. Review and Create
5. Secrets [left pane]
1. Create a secret
1. name = keyname
2. value = secret value
3. Create
6. Access policies -> Add Access Policy -> Secret permissions -> Select all -> principal -> search app registration name -> Save
7. In ASP.NET Core -> App Settings

 "Keyvault": {
    "Vault": "keyvault-myapp",
    "ClientId": "#2",
    "ClientSecret": "#4.1"
  }

     8. Add Nuget package -> Microsoft.Extensions.Configuration.AzureKeyVault

     9. Program.cs

namespace Web
{
    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
           Host.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((context, config) =>
            {

                var root = config.Build();
                config.AddAzureKeyVault($"https://{root["KeyVault:Vault"]}.vault.azure.net/", root["KeyVault:ClientId"], root["KeyVault:ClientSecret"]);
            })
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>();
            });
    }
}

    10. Controller

 public class MyController : Controller  
{  
    private readonly IConfiguration _configuration;  

    public ValuesController(IConfiguration configuration)  
    {  
        _configuration = configuration;  
    }  

    [HttpGet]  
    public string Get()  
    {  
        var value = _configuration["keyname"];  
    }  
}