Automated secrets rotation in Azure Key Vault (Part 2) - AAD App Client Secret

[@AmazoXD]

Hi Jack, I wanted to manage the rotation of multiple client secrets, can we do with one set of infrastructure you have created for demo ?

[@jacklichwa4651]

Yes you can use a single function for all your secrets. But some logical grouping like one function per closely related secrets to have proper isolation and minimize impact in case of breach or other issue.

[@nelsonrivers8546]

Can you add a video to show how to use C# code that can go about programmatically picking up a key from key vault when "Automatic Key Rotation" is in effect ? I have no idea how to make use of "Automatic Key Rotation" from a console application or a Web API to pickup the most current key after key rotation.

[@jacklichwa4651]

This is secrets rotation, but I wrote quick starts in public docs how to get any objects stored. Anytime you don't provide version it will get latest(so as long you periodically poll you will get newest or use event grid to get notified when rotation happens).

[@armaans64]

Is there any way to use rbac to integrate kv , event grid and functionApp and storage instead of using sas Keys on storage account as use that in functionApp as azurestoragewebjobs and vault access configuration

[@azuresecretsmanagement4926]

Yes you can do it now, besides that you will also need to not use Azure Files connection to completely disable keys on Storage Account: learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#create-an-app-without-azure-files

[@armaans64]

How manually add function app powershell code on functionApp

[@jacklichwa4651]

The easiest way is probably use one of the examples and then edit (you can do it in Portal UX). Otherwise you will likely need to use VS Code.

[@wylanosorio8835]

Thank you for this! The powershell script that gives Graph API permissions to Azure Function, do you know how to do that manually in the Azure Portal?

[@jacklichwa4651]

Not possible in Portal UX.

[@hvalentino9573]

Thank you for the video! But how do we get the secret if this will be automated and probably too late to copy the value.

[@jacklichwa4651]

Secret will be in Key Vault.

[@2012pavankumar]

Thank you.. Could you please provide the github link.?

[@azuresecretsmanagement4926]

If you open the link with function, there is open github button