Where should an API key for a downstream service be stored?
Why C is the answer
Azure Key Vault
Key Vault stores and controls access to tokens, passwords, certificates and API keys.
In detail
- Key Vault stores secrets securely.
- Never commit secrets to a repository.
Use case
An illustrative scenario, not a real incident.
A service needs a partner API key. It goes in Azure Key Vault, and the app reads it at run time.
See it in different ways
sequenceDiagram participant A as App with managed identity participant E as Microsoft Entra ID participant K as Key Vault A->>E: Request a token E-->>A: Token A->>K: Get secret K-->>A: Secret value
sequenceDiagram participant A as App participant C as App Configuration participant V as Key Vault A->>C: Reads settings and flags C-->>A: Key Vault reference A->>V: Reads the secret, with its managed identity V-->>A: Current value
flowchart LR S0["Store in Key Vault"] --> S1["App identity gets access"] --> S2["Read at run time"]
Key point: Secrets belong in Key Vault.
Why the other options are wrong
- A. In a container image layer
- Image layers can be read.
- B. In a code comment near the place it is used
- A comment exposes the key.
- D. In appsettings.json, committed to the repository
- A committed file exposes the key.