How to securely access Azure Keyvault from Docker Compose

Question

My understanding is that managed identities are not supported with muti-container web apps. In that case, I am wondering what is the recommended secure way to access Azure keyvault from a Docker compose web application.One option is to create a service principal, grant it access to the keyvault and store the service principal's credentials in the environment file. Is that the recommended approach to access keyvault from docker compose webapp? Please let me know if there are other options available.

Answer 1

The most secure option is to use managed identity; as you say, you cannot do this with a multi-container app service. However, this can be achieved using Azure Container apps, so one option would be to move to using that. If you want to stick with App Service, then using a service principle would be the next best option, but you will need to ensure you keep good security around the credentials and rotate it regularly.