Ways to automatically rotate the two OpenAI keys

Question

Hello dear colleagues,

We would like to know if there is a way available in Azure to automate the rotation of the two OpenAI keys and have them stored in Azure Key Vault. Is there any way to do this? Thank you very much in advance.

Answer 1

Hi Martín Delgado, Andrea,

Yes, you're absolutely on the right track by using Azure Key Vault for secure key management. While Azure OpenAI does not natively support automatic key rotation out of the box (as of now), you can automate the rotation of OpenAI keys using Azure automation tools such as Azure Functions, Logic Apps, and Key Vault in combination. Here's a detailed explanation and strategy to achieve this:

Azure provides two OpenAI keys per resource for redundancy. You can rotate them manually via the Azure portal, but to automate the rotation and store them securely in Key Vault, you'll need to implement a custom automation flow.

Step1: Use Azure CLI or REST API to Regenerate the OpenAI Key

Azure supports regenerating OpenAI resource keys using REST APIs:

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CognitiveServices/accounts/{accountName}/regenerateKey?api-version=2023-05-01

You can choose to regenerate either:

{
  "keyName": "Key1"  // or "Key2"
}

You must authenticate using a service principal or managed identity that has the appropriate RBAC role (e.g., Cognitive Services Contributor).

Step2: Store the Rotated Key in Azure Key Vault

After the key is regenerated, you can:

·       Use Azure CLI

·       Or use Azure SDK for Python/PowerShell/Node.js

·       To update the key in Azure Key Vault:

az keyvault secret set --vault-name "YourKeyVaultName" --name "OpenAI-Key1" --value "new-key-value"

Step3: Automate Using Azure Function or Logic App

You can set up an Azure Function (Python) or Logic App that:

·       Triggers periodically (e.g., every 30 days)

·       Calls the REST API to rotate the selected key

·       Stores the new key value in Key Vault

·       Optionally logs the rotation event (Log Analytics, Email, etc.)

Step4: Using Managed Identity for Secure Automation

Assign a Managed Identity to your automation service (Azure Function or Logic App) and grant:

·       Key Vault Secrets Officer role to update secrets

·       Cognitive Services Contributor role to regenerate keys

Hope this helps, do let me know if you have any queries.

Thank you!