Introduction
Modern applications rely on sensitive information such as database connection strings, API keys, encryption certificates, and authentication secrets. Storing these values directly in source code or configuration files creates significant security risks and makes secret management difficult.
Azure Key Vault is a cloud service that securely stores and manages secrets, cryptographic keys, and certificates. It integrates seamlessly with ASP.NET Core and other Azure services, helping developers protect sensitive information while simplifying secret rotation and access control.
In this article, you'll learn how to use Azure Key Vault in ASP.NET Core, understand its core capabilities, and follow best practices for securing application secrets.
What Is Azure Key Vault?
Azure Key Vault is a managed service that securely stores and controls access to sensitive application data.
It supports three primary types of assets:
Secrets
Cryptographic keys
Certificates
Applications can retrieve these assets securely at runtime without storing them in source code.
Why Use Azure Key Vault?
Hardcoding secrets or storing them in configuration files can expose your application to unnecessary risk.
Azure Key Vault offers several advantages:
Centralized secret management
Secure storage with encryption
Automatic secret rotation support
Fine-grained access control
Audit logging
Integration with Azure services
Improved compliance
These capabilities help protect sensitive information throughout the application lifecycle.
What Can You Store?
Azure Key Vault can securely store various types of sensitive data.
Examples include:
Using a single secure location simplifies secret management across environments.
Install the Required Package
Install the Azure Key Vault configuration provider.
dotnet add package Azure.Extensions.AspNetCore.Configuration.Secrets
You also need the Azure Identity package.
dotnet add package Azure.Identity
These packages enable your application to authenticate and retrieve secrets from Key Vault.
Configure Azure Key Vault
Add Azure Key Vault during application startup.
using Azure.Identity;
var builder = WebApplication.CreateBuilder(args);
builder.Configuration.AddAzureKeyVault(
new Uri("https://your-keyvault.vault.azure.net/"),
new DefaultAzureCredential());
The application can now access secrets stored in the configured Key Vault.
Store a Secret
Suppose you create a secret named:
DatabaseConnection
With a value such as:
Server=server;Database=AppDb;User Id=admin;Password=********;
The actual value remains securely stored in Azure Key Vault instead of your project files.
Read a Secret
Once configured, retrieve the secret like any other configuration value.
string connectionString =
builder.Configuration["DatabaseConnection"];
No additional API calls are required because the configuration provider handles secret retrieval.
Use Managed Identity
For Azure-hosted applications, use Managed Identity instead of storing credentials.
Benefits include:
DefaultAzureCredential automatically uses the managed identity when the application runs in Azure.
Control Access with RBAC
Limit access to Key Vault using Azure Role-Based Access Control (RBAC).
Grant only the permissions required for each application or user.
Common roles include:
Following the principle of least privilege reduces the impact of compromised accounts.
Rotate Secrets Regularly
Secrets should not remain unchanged indefinitely.
Regular rotation helps:
When rotating secrets:
Update the secret in Key Vault.
Restart the application if necessary, or implement configuration refresh.
Verify that dependent services continue to function correctly.
A documented rotation process minimizes operational risk.
Protect Certificates and Keys
Azure Key Vault also manages certificates and cryptographic keys.
Typical scenarios include:
Keeping these assets in Key Vault centralizes security and simplifies lifecycle management.
Enable Logging and Monitoring
Monitor Key Vault activity to detect unusual behavior.
Useful information includes:
Integrating diagnostic logs with Azure Monitor helps improve visibility and supports security audits.
Secure Local Development
Developers should avoid storing production secrets on local machines.
For local development:
Use Azure CLI authentication.
Sign in with Visual Studio or Visual Studio Code.
Store development-specific settings separately.
Avoid committing secrets to source control.
These practices help maintain a secure development workflow.
Best Practices
When using Azure Key Vault, follow these recommendations:
Never hardcode secrets in source code.
Use Managed Identity whenever possible.
Apply the principle of least privilege.
Rotate secrets on a regular schedule.
Store certificates and encryption keys in Key Vault.
Monitor access logs for suspicious activity.
Keep secret names meaningful and consistent.
Separate Key Vaults for development, testing, and production environments.
These practices strengthen your application's security posture.
Common Mistakes to Avoid
Many security incidents stem from poor secret management.
Avoid these common mistakes:
Storing secrets in source control.
Sharing secrets between multiple environments.
Granting excessive permissions.
Ignoring secret rotation.
Using production secrets during development.
Failing to monitor Key Vault access.
Embedding credentials in container images or deployment scripts.
Preventing these issues helps reduce the likelihood of credential exposure.
Azure Key Vault vs Configuration Files
The following comparison illustrates the benefits of using Azure Key Vault.
| Feature | Configuration Files | Azure Key Vault |
|---|
| Secure Secret Storage | No | Yes |
| Encryption at Rest | Limited | Yes |
| Secret Rotation | Manual | Supported |
| Access Control | Basic | Fine-Grained |
| Audit Logging | No | Yes |
| Centralized Management | No | Yes |
Azure Key Vault provides a much more secure and manageable solution for protecting sensitive information.
Conclusion
Azure Key Vault is a foundational service for securing modern ASP.NET Core applications. By centralizing the storage of secrets, keys, and certificates, it eliminates the need to embed sensitive information in source code or configuration files while providing robust access control, auditing, and integration with Azure services.
By adopting practices such as using Managed Identity, implementing least-privilege access, rotating secrets regularly, and monitoring Key Vault activity, you can significantly improve the security and maintainability of your applications across development, testing, and production environments.