Application with Managed Identity
Cloud / Knowledge library
Azure Key Vault Secrets
Stores secrets with Azure identity, access policy, logging, and versioning
Why learn Azure Key Vault Secrets?
Teams use Azure Key Vault Secrets to adopt managed secrets without building the complete underlying platform themselves.
The problem it solves
Stores and controls application credentials, tokens, and other sensitive configuration
Where it came from
Azure Key Vault Secrets is Microsoft Azure's offering for managed secrets. Its closest catalog counterparts are AWS Secrets Manager and Google Cloud Secret Manager; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of Azure Key Vault Secrets.
- Choose a workload that fits Azure Key Vault Secrets.
- Identify one operational tradeoff of Azure Key Vault Secrets.
- Compare Azure Key Vault Secrets with AWS Secrets Manager.
- Compare Azure Key Vault Secrets with Google Cloud Secret Manager.
Documentation and sources
- Microsoft Azure product catalog (azure.microsoft.com)
Connect the ideas
Alternatives
Real World Example
Centralized Secret Management for Distributed Microservices
Organizations running distributed microservices that require secure access to database connection strings, API keys, and certificates across multiple environments.
The business problem
Hardcoded credentials in application code or configuration files lead to security vulnerabilities, difficulty in rotating secrets, and lack of audit trails for secret access.
How this topic solves it
Azure Key Vault provides a centralized, cloud-based store that decouples sensitive configuration from application code, utilizing Azure identity for fine-grained access control and built-in versioning for rotation.
- Provision an Azure Key Vault instance within the target resource group.
- Assign a Managed Identity to the application service to enable secure, passwordless authentication.
- Configure Key Vault access policies or RBAC to grant the Managed Identity specific permissions to read secrets.
- Store sensitive values as named secrets within the vault, utilizing versioning to track changes.
- Enable diagnostic logging to monitor all access requests and secret retrieval operations.
The flow illustrates how an application authenticates via identity to access secrets.
Centralized Secret Store
Audit and Diagnostic Logs
- Microservice → Requests secret via Managed Identity → Azure Key Vault
- Azure Key Vault → Emits access telemetry → Azure Monitor
Expected business outcome
Improved security posture through centralized credential management, reduced risk of credential leakage, and simplified compliance via comprehensive audit logging.
Limitations and checks
Key Vault access is subject to service limits on request rates; applications must implement exponential backoff retry logic to handle potential throttling during high-concurrency scenarios.