☁️ Azure Key vault Short Notes

🟢 What is Azure Key Vault?

• A cloud service for securely storing and accessing secrets, keys, and certificates.
• Removes the need to keep secrets (like connection strings, passwords, API keys) inside code or config files.
• Provides centralized secret management, encryption, and access control.

👉 Think of it like a secure password manager but for your applications.

---

🟢 Key Features

1. Secrets → store text values (e.g., DB connection string, API key).
2. Keys → store cryptographic keys (RSA, EC) for encryption, signing.
3. Certificates → store/manage SSL/TLS certificates.
4. Access Control →
   • Access Policies (older model).
   • Azure RBAC (modern, preferred).
5. Integration → works with App Service, Functions, AKS, VMs, SQL DB, etc.
6. Logging → audit who accessed secrets via Azure Monitor / Diagnostic Logs.

---

🟢 Why Use Key Vault?

• Security → secrets are encrypted with HSM (Hardware Security Modules).
• Compliance → meet industry standards (PCI-DSS, ISO, GDPR).
• Automation → auto-rotate secrets & certificates.
• Centralized Management → single place for secrets across apps.

---

🟢 Accessing Key Vault

• Azure Portal / CLI → manually store secrets.
• Applications → use Managed Identity for secure access.
• SDKs → Azure SDK for .NET, Python, etc.

👉 Never hardcode secrets. Instead, use DefaultAzureCredential from SDK.

---

🟢 Example: Access Key Vault in .NET

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using System;
using System.Threading.Tasks;

class Program
{
    static async Task Main()
    {
        // Key Vault URL
        string kvUrl = "https://<your-keyvault-name>.vault.azure.net/";

        // Authenticate using Managed Identity / Azure AD
        var client = new SecretClient(new Uri(kvUrl), new DefaultAzureCredential());

        // Get a secret
        KeyVaultSecret secret = await client.GetSecretAsync("DbConnectionString");

        Console.WriteLine($"✅ Secret value: {secret.Value}");
    }
}

---

🟢 Security Best Practices

• Use Managed Identity for apps (don’t use keys/passwords).
• Use RBAC instead of Access Policies for fine-grained access.
• Rotate secrets regularly (Key Vault supports auto-rotation).
• Enable soft delete and purge protection to prevent accidental loss.

---

🟢 Common Interview Questions

1. What is Azure Key Vault and why is it used?
2. Difference between Secrets, Keys, and Certificates?
3. How does an App Service access Key Vault without storing credentials?
4. Access Policies vs. Azure RBAC → which one is recommended?
5. How do you secure access to Key Vault?
6. Can Key Vault auto-rotate secrets?
7. Difference between Key Vault and App Config?
8. How do you monitor Key Vault usage?

---

🟢 Pros & Cons

✅ Pros

• Centralized, secure secret management.
• Easy integration with Azure services.
• RBAC + Managed Identity support.
• HSM-backed key storage.

❌ Cons

• Latency overhead (extra call to Key Vault).
• Costs increase with high-frequency secret access.
• Requires internet access (unless using private endpoints).

---

✅ Quick Recap

• Azure Key Vault = secure store for secrets, keys, and certificates.
• Access using Managed Identity + Azure SDK.
• Use RBAC (modern) instead of Access Policies.
• Best practices → rotate secrets, enable purge protection, monitor access.