How to auto wire KeyClient with Spring Cloud Azure without including unnecessary configuration properties?

Question

I have set up a Spring Cloud Azure application. I use both secrets and keys in my Azure Keyvault. I started with integrating secrets and followed https://spring.io/projects/spring-cloud-azure, which allows me to autowire a Secret Client with only the following in my application configuration properties yaml

spring:
  cloud:
    azure:
      keyvault:
        secret:
          endpoint:

I got it set up and working pretty smoothly. Then I moved on to KeyClient, thinking that I could reuse some of this setup, but I couldn't find something similar even in the source code Does that mean I still have to include all the other config props like clientId, clientSecret, etc? it seems that I will end up having to implement everything under "Without Spring Cloud Azure" AND everything under "With Spring Cloud Azure", when I could just do the former which is necessary for KeyClient anyway. Please correct me if I'm wrong. Thanks!

Answer 1

Hi @Ian Lee ,

Thanks for reaching out.

KeyClient and Spring Cloud Azure are two different approaches to accessing Azure Key Vault in a Java application.

KeyClient is a client library provided by Azure SDK for Java that allows you to interact with Azure Key Vault to manage keys, certificates, and secrets. It provides a low-level API for accessing Azure Key Vault, which means that you will need to handle authentication, authorization, and other details yourself. You can use KeyClient to retrieve keys, create keys, delete keys, and perform other key management operations.

Spring Cloud Azure, on the other hand, is a framework that provides a higher-level abstraction for accessing Azure services, including Azure Key Vault. It provides a set of Spring Boot starters that you can use to configure your application to use Azure services. Spring Cloud Azure provides a more convenient way to access Azure services, but it may not provide the same level of control as using KeyClient directly. I am not able to come across any sample documentation to autowire KeyClient with Spring cloud configration.

To auto wire KeyClient with Spring Cloud Azure without including unnecessary configuration properties, you can use the azure-keyvault-keys-spring-boot-starter dependency and directly inject KeyClient into your Spring application. This approach allows you to use the configuration properties that you're already familiar with to configure Key Vault. For more information, see Configuration examples. You do not need to include unnecessary configuration properties such as clientId and clientSecret.

Here is an example of how to inject KeyClient into your Spring application:

import com.azure.security.keyvault.keys.KeyClient;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class KeyClientConfiguration {

    @Autowired
    private KeyVaultProperties keyVaultProperties;

    @Bean
    public KeyClient keyClient() {
        return new KeyClientBuilder()
                .vaultUrl(keyVaultProperties.getVaultUri())
                .credential(new DefaultAzureCredentialBuilder().build())
                .buildClient();
    }
}

In this example, KeyVaultProperties is a custom class that holds the configuration properties for Key Vault, including the vaultUri. The DefaultAzureCredentialBuilder is used to authenticate with Azure Key Vault. Hope this will help. Thanks,

Shweta