You plan to deploy a container to an Azure App Service API app named api1. You host the source code for api1 in a GitHub repository. The container uses the API key at runtime to connect to a backend service.
The container must be able to retrieve the API key at runtime without exposing it in the source repository or Git commit history. The API key must not be stored in application configuration directly. The API key must be accessed securely from Azure Key Vault.
You need to ensure that the API key is stored securely in Azure Key Vault and is available to the container at runtime without being exposed in source control or Git commit history.
Solution: Store the API key as an App Service application setting configured through the Azure Portal.
Does the solution meet the goal?
The solution does not meet the goal. Storing the API key as an App Service application setting through the Azure Portal violates the requirements in several ways:
Problems:
- App Service application settings are stored in plaintext or as encrypted configuration values, not in Azure Key Vault, which is the specified requirement.
- Application settings can be viewed in the portal and may appear in deployment templates or Git history if accidentally committed.
- The requirement explicitly states the API key must not be stored in application configuration directly.
- This approach does not leverage Key Vault's secure storage and secret rotation capabilities.
Correct approach: Use Azure Key Vault references in App Service configuration (format: @Microsoft.KeyVault(SecretUri=...)) combined with managed identity, or use Key Vault SDK in the application code to retrieve the secret at runtime.