How can I have Azure App Service environment variables override key vault secrets?

Question

How can I have Azure App Service environment variables override key vault secrets?

David Thielen 3,211

Hi all;

If I define a string in both the Key Vault and the Azure App Service environment variables, the app will read the Key Vault entry.

Is there a way to have it read the App Service value if set?

thanks - dave

TP 125.8K Reputation points Volunteer Moderator

2024-07-09T23:21:58.4666667+00:00

Hi Dave,

Each environment variable must have a unique name, so either the variable will be sourced from key vault via reference or app service, depending on how you set it. Based on this I'm unsure what you are asking.

You could of course build your own abstraction that would do what you want. For example, you could have code that would check for existence of VARIABLENAME_OVERRIDE and if it exists use that instead of the default behavior.

-TP
David Thielen 3,211 Reputation points

2024-07-10T13:38:09.6166667+00:00
@TP I have the connection string to my Azure BLOB Storage in the Key Vault. For the dev slot I want to use a different storage account and therefore a different connection string. I was hoping that setting that in the Azure App Server environment variables would override the key vault setting.

Is there any way to do that? As best as I can tell it gets any config setting from the first it finds in the order:

Key Vault

Azure App Server

AppSettings.json

I'd prefer the order:

Azure App Server

Key Vault

AppSettings.json

thanks - dave

Accepted answer

1 additional answer

Your answer

TP 125.8K Reputation points Volunteer Moderator

2024-07-09T23:21:58.4666667+00:00

Hi Dave,

Each environment variable must have a unique name, so either the variable will be sourced from key vault via reference or app service, depending on how you set it. Based on this I'm unsure what you are asking.

You could of course build your own abstraction that would do what you want. For example, you could have code that would check for existence of VARIABLENAME_OVERRIDE and if it exists use that instead of the default behavior.

-TP
David Thielen 3,211 Reputation points

2024-07-10T13:38:09.6166667+00:00

@TP I have the connection string to my Azure BLOB Storage in the Key Vault. For the dev slot I want to use a different storage account and therefore a different connection string. I was hoping that setting that in the Azure App Server environment variables would override the key vault setting.

Is there any way to do that? As best as I can tell it gets any config setting from the first it finds in the order:

Key Vault

Azure App Server

AppSettings.json

I'd prefer the order:

Azure App Server

Key Vault

AppSettings.json

thanks - dave

Answer 1

Bruce (SqlWork.com) 78,006 Volunteer Moderator

instead of using the default, add the configuration providers in your code.

// defaults
var builder = WebApplication.CreateBuilder(args);

// remove config sources
builder.Configuration.Sources.Clear();

// add config providers in order you want:
builder.Configuration.AddEnvironmentVariables();
...

David Thielen 3,211 Reputation points

2024-07-15T15:15:28.1266667+00:00
@Bruce (SqlWork.com) This is perfect. Can you elaborate to answer the below?

To confirm, last added wins. So I think I want (let me know if you have a suggestion):

Environment

File (appSettings.json)

AzureKeyVault/UserSecrets

Key Vault on Azure, User Secrets on my desktop

AzureApp

Or should Environment be 3.5? I never use it but if it is set by something, is the expectation that it comes first?

Or to ask it another way, what is the default ordering? Because I want to keep that default with the one change.

thanks - dave
Bruce (SqlWork.com) 78,006 Reputation points Volunteer Moderator

2024-07-15T17:56:00.12+00:00

the docs list the order:

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-8.0

Answer 2

Bruce (SqlWork.com) 78,006 Volunteer Moderator

The order of precedence of config providers is the opposite order of adding. That is the last one wins. To control the order, you need to manually add the providers in the order you want rather than the default.

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/configuration/?view=aspnetcore-8.0

David Thielen 3,211 Reputation points

2024-07-10T17:26:19.8666667+00:00

@Bruce (SqlWork.com) That makes sense. I read the link and that validates it. But I didn't see a way to add the key vault so that App Server vars come first.

Is there a way?

If not, what's your suggestion for vars where I need to not use the KeyVault for some of them for the dev slot (do need the KeyVault for others)?

thanks - dave
David Thielen 3,211 Reputation points

2024-07-10T22:43:42.2266667+00:00
@Bruce (SqlWork.com) This is perfect. If you make it an answer, happy to select it.

To confirm, last added wins. So I think I want (let me know if you have a suggestion):

Environment

File (appSettings.json)

AzureKeyVault/UserSecrets

Key Vault on Azure, User Secrets on my desktop

AzureApp

Or should Environment be 3.5? I never use it but if it is set by something, is the expectation that it comes first?

thanks - dave

Share via

How can I have Azure App Service environment variables override key vault secrets?

1 additional answer

Your answer