AZ-400: Azure Key Vault for secrets — pipeline and app

[zkarachiwala]

Exam objective

Store application secrets in Azure Key Vault and consume them from App Service via Key Vault references, with no plaintext credentials in App Settings
(Design and implement a security and compliance plan — 10–15%)

Cost note

Key Vault Standard tier is consumption-based. For a personal app making fewer than 1,000 secret reads/month, cost is under AUD $0.01/month.

Read first

• Azure Key Vault secrets
• Use Key Vault references in App Service
• azure/get-keyvault-secrets GitHub Action

What to build

An Azure Key Vault holding the database connection string, referenced by App Service transparently — no plaintext connection string in App Settings. The pipeline also reads a secret from Key Vault during the migration step.

Your task

1. Create a Key Vault (Standard tier) in the Azure Portal, same region as the App Service
2. Store the database connection string as a secret named ConnectionStrings--DefaultConnection
3. Enable the App Service's System-assigned Managed Identity (Settings → Identity → System assigned → On)
4. Grant the Managed Identity Key Vault Secrets User role on the Key Vault (Key Vault → Access control (IAM) → Add role assignment)
5. Replace the ConnectionStrings__DefaultConnection App Setting with a Key Vault reference:

   @Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/ConnectionStrings--DefaultConnection/)
   

6. Restart the App Service — verify the reference shows a green checkmark (resolved) in Configuration
7. Confirm the app still loads and logs in correctly

Explore

# List secrets in the vault:
az keyvault secret list --vault-name <vault-name> --output table

# Read a secret value (requires Key Vault Secrets Officer or Administrator role):
az keyvault secret show --vault-name <vault-name> --name ConnectionStrings--DefaultConnection \
  --query value -o tsv

# Check the App Service sees the reference as resolved:
az webapp config appsettings list --name timetracker-zak --resource-group <rg> \
  --query "[?name=='ConnectionStrings__DefaultConnection']"
# The value should show @Microsoft.KeyVault(...) — resolution happens at runtime, not here

# In the Azure Portal → App Service → Configuration, look for the green key icon next to the setting

Exam checkpoint

• What is a Key Vault reference in App Service and how does it differ from a direct value in App Settings?
• What Azure RBAC role grants read-only access to Key Vault secrets?
• What is the difference between Key Vault access policies and Azure RBAC for Key Vault data plane?
• When App Service uses a Key Vault reference, how often is the secret refreshed?
• What is the difference between a Key Vault Secret, Key, and Certificate?

[zkarachiwala]

Moved to study-plans — tracked in the Certifications project.