Azure web app connection string in configuration fetch values from KeyVault - security

Question

I need to configure passwords to be fetched from Azure KeyVault in Azure Web App connection string. Can someone explain how to configure it ?
Thanks in advance !
I tried to get the passwords from key vault in Application settings and it worked fine , but couldn't able to integrate it in connection string.

Answer 1

Create an Azure KeyVault.
Create Secret. Copy the Secret Identifier of the Secret (this has to be used in Azure Configuration Connection String).
Provide necessary grants by using Access policies.
In Azure App Service => Configuration => Application Settings => Connection Strings, add the new Connection string setting.
For .NET Core App, the key name has to be MyNewConn.
For .NET Framework App, the name in the Azure App Connection String must be same as the key name in Local Configuration.
Thanks #Anand Sowmithiran for the Comment.
The value of the Connection string has to be #Microsoft.KeyVault(SecretUri=Secret Identifier).
Replace the Secret Identifier value with the value which we have copied from the KeyVault Secret (In Step 1).
For .NET Core Web App
appsettings.json
"ConnectionStrings": {
"MyNewConn": "LocalValue"
}
string connectionString = configuration.GetConnectionString("MyNewConn");
For .NET Framework Web App
In Web.config file, you must have the below settings
<configSections>
<section name="configBuilders" type="System.Configuration.ConfigurationBuildersSection, System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=*****" restartOnExternalChanges="false" requirePermission="false" />
</configSections>
<configBuilders>
<builders>
<add name="AzureKeyVault" vaultName="KeyVaultName" type="Microsoft.Configuration.ConfigurationBuilders.AzureKeyVaultConfigBuilder, Microsoft.Configuration.ConfigurationBuilders.Azure, Version=1.0.0.0, Culture=neutral" vaultUri="https://YourKeyVaultName.vault.azure.net" />
</builders>
</configBuilders>
<connectionStrings>
<add name="MyNewConn" connectionString="Retrieves the value from Azure App Service Connection String" providerName="System.Data.SqlClient" />
</connectionStrings>
var conn = ConfigurationManager.ConnectionStrings["MyNewConn"];
Update
In Azure Key Vault, the step where we create the Secret, add the Secret value as the connection string.
.
Rest other steps are same.