This article is a solution idea. If you'd like us to expand the content with more information, such as potential use cases, alternative services, implementation considerations, or pricing guidance, let us know by providing GitHub feedback.
This article outlines a solution for creating a robust and scalable application in a distributed environment. The solution uses Azure App Configuration and Azure Key Vault to manage and store app configuration settings, feature flags, and secure access settings in one place.
The following diagrams show how App Configuration and Key Vault can work together to manage and secure apps in development and Azure environments.
In the development environment, the app uses an identity via Visual Studio or version 2.0 of the Azure CLI to sign in and send an authentication request to Azure Active Directory (Azure AD).
Azure staging or production environment
The Azure staging and production environments use an Azure Managed Service Identity (MSI) for sign-in and authentication.
Download a Visio file of this architecture.
- The application sends an authentication request during debugging in Visual Studio, or authenticates via the MSI in Azure.
- Upon successful authentication, Azure AD returns an access token.
- The App Configuration SDK sends a request with the access token to read the app's App Configuration Key Vault secretURI value for the app's key vault.
- Upon successful authorization, App Configuration sends the configuration value.
- Utilizing the sign-in identity, the app sends a request to Key Vault to retrieve the application secret for the secretURI that App Configuration sent.
- Upon successful authorization, Key Vault returns the secret value.
- Azure AD is a universal platform for managing and securing identities.
- App Configuration provides a way to store configurations for all your Azure apps in a universal, hosted location.
- Azure Managed Service Identity offers managed identities that provide an identity for applications to use when connecting to resources that support Azure AD authentication.
- Key Vault safeguards cryptographic keys and other secrets that are used by cloud apps and services.
Cloud-based applications often run on multiple virtual machines or containers in multiple regions, and use multiple external services. Creating a robust and scalable application in a distributed environment presents a significant challenge.
By using App Configuration, you can manage and store all your app's configuration settings, feature flags, and secure access settings in one place. App Configuration works seamlessly with Key Vault, which stores passwords, keys, and secrets for secure access.
Potential use cases
Any application can use App Configuration, but the following types of applications benefit most from it:
- Microservices that are based on Azure Kubernetes Service (AKS), Azure Service Fabric, or other containerized apps that are deployed in one or more regions.
- Serverless apps, which include Azure Functions or other event-driven stateless compute apps.
- Apps that use a continuous deployment (CD) pipeline.
These considerations implement the pillars of the Azure Well-Architected Framework, which is a set of guiding tenets that can be used to improve the quality of a workload. For more information, see Microsoft Azure Well-Architected Framework.
It's best to use a different key vault for each application in each environment: development, Azure pre-production, and Azure production. Using different vaults helps prevent sharing secrets across environments, and reduces threats in the event of a breach.
To use these scenarios, the sign-in identity must have the App Configuration Data Reader role in the App Configuration resource, and have explicit access policies for retrieving the secrets in Key Vault.
This article is maintained by Microsoft. It was originally written by the following contributors.
- Sowmyan Soman | Principal Cloud Solution Architect
Learn more about the component technologies:
- Azure App Configuration
- Azure Key Vault
- Use Key Vault references for App Service and Azure Functions
- App Configuration and Managed Service Identity
- Local development and security