CODEWITHSUNDEEP
azure.net-coreazure-devopsazure-cosmosdbazure-keyvault
Jeevan
Jeevan

Reputation: 437

How do I securely store connection strings client id etc?

Let me give some details of my setup

I am building an asp.net core API app being hosted on Azure. I store my secret keys and stuff in azure keyvault. However, I have some AzureAddClientId and secret which is now stored in appsettings.json( to access key vault ). I have also committed appsettings.json to my git repo. However I know that is insecure. I use Azure DevOps for releases. So I'm thinking of doing the following. Please let me know your thoughts on this.

  1. add appsettings.json to git ignore and share the file among developers.
  2. add AzureAddClientId and AzureAADClientSecret to azure DevOps build pipeline as variables. ( Will devops automatically take the variables just as if they were in appsettings.json? )

Upvotes: 0

Views: 200

Answers (1)

rickvdbosch
rickvdbosch

Reputation: 15551

Please have a look at using Managed Identities.

A common challenge when building cloud applications is how to manage the credentials in your code for authenticating to cloud services. Keeping the credentials secure is an important task. Ideally, the credentials never appear on developer workstations and aren't checked into source control. Azure Key Vault provides a way to securely store credentials, secrets, and other keys, but your code has to authenticate to Key Vault to retrieve them.

The managed identities for Azure resources feature in Azure Active Directory (Azure AD) solves this problem. The feature provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.

Upvotes: 2

Related Questions