0

I have developed an Azure Function using visual Studio 2019. now when i deployed the Azure Function inside Azure >> all the settings (which contain some sensitive info) inside the local.settings.json, will be added inside the ""Azure Configuration" >> "App settings"". And as indicated by the page message that those values are stored encrypted, as follow:-

enter image description here

so does this mean that there is no need to take extra steps to secure the sensitive info inside the App setting by using Azure Key Vault ? as those are already secured?

John John
  • 1
  • 72
  • 238
  • 501

2 Answers2

2

They are secure, but users with permissions to the recourse can potentially access them with a role such as e.g. Contributor. Using a Key Vault would allow you to define access controls more precisely.

As example; Should somebody whose sole responsibility is to manage the resource have access to the secrets?

Also Key Vault allows for some other scenario's like being able to manage secrets centrally or share them across multiple resources (e.g. App Services across multiple regions). And maybe one that's often overlooked; monitoring. E.g. being able to tell 'who' accessed what key at what time.

Edit: link for adding key vault references to your app settings

NotFound
  • 5,005
  • 2
  • 13
  • 33
  • ok got your point, so can we store those values inside Key Vault and allow our Azure Function to access those keys from the Azure key vault instead from been read from the App Settings? – John John Jan 27 '23 at 11:02
  • 2
    In your app settings you can add a reference to a key vault secret `@Microsoft.KeyVault(SecretUri=https://.vault.azure.net/secrets/)` as value. Add a system assigned identity (user assigned works as well but requires more steps) to your web app resource and you can give that permission on the key vault to access the secrets. In your app settings you should see a column that specifies whether or not the resource is able to obtain the secret. You don't need any code changes in your app that way. – NotFound Jan 27 '23 at 12:17
1

It is considered a best practice to store any secrets your application might need in a Key Vault. This way, if someone has access to the application that needs to use these secrets in the Azure portal, they would still not have access to the actual secret.

Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked. When application developers use Key Vault, they no longer need to store security information in their application. Not having to store security information in applications eliminates the need to make this information part of the code. For example, an application may need to connect to a database. Instead of storing the connection string in the app's code, you can store it securely in Key Vault.

Your applications can securely access the information they need by using URIs. These URIs allow the applications to retrieve specific versions of a secret. There's no need to write custom code to protect any of the secret information stored in Key Vault.

Source: About Azure Key Vault - Why use Azure Key Vault? - Centralize application secrets

TL;DR
Do you need to use Key Vault currently? Maybe not, although still depending on how many other people have access to the Subscription / Resource Group / Function App.

Would I advise you to put your secrets in Key Vault? Yes. Especially by doing so now will get you used to working with Key Vault and get you prepared for the future.

EDIT:
For referencing secrets from Key Vault, have a look at Key Vault references. This enables your application to get the secrets from Key Vault without the need for any code change!

For documentation on how to, please see Use Key Vault references for App Service and Azure Functions.

EDIT 2:

even if we store them inside Azure key vault they can be viewed

Yes, but then only if someone has the correct role assignment. If the secret is in Application Settings, anyone with access to the Function App inside of the Azure portal can also see the secrets.

rickvdbosch
  • 14,105
  • 2
  • 40
  • 53
  • ok got your point, so can we store those values inside Key Vault and allow our Azure Function to access those keys from the Azure Key Vault instead from been read from the App Settings? – John John Jan 27 '23 at 11:03
  • Ok thanks again for the great help ... so i am following those steps @ https://levelup.gitconnected.com/a-secure-way-to-use-credentials-and-secrets-in-azure-functions-7ec91813c807 .. so in short, the App Settings will not be storing the actual secret values it will be storing the URI of the secret.. but let say i modify the function locally and i re-deploy it to Azure, will i need to resubmit the uri of the secrets each time? – John John Jan 27 '23 at 11:47