App Configuration values point at secrets. How do you link them safely?
Why B is the answer
Use Key Vault references
References keep secrets in Key Vault, while configuration holds only a pointer.
In detail
- Key Vault references point to the secret, and do not copy it.
- The app needs access to both services.
Use case
An illustrative scenario, not a real incident.
A setting must point at a secret. A Key Vault reference does that, so App Configuration never holds the value.
See it in different ways
sequenceDiagram participant A as App participant C as App Configuration participant V as Key Vault A->>C: Reads settings and flags C-->>A: Key Vault reference A->>V: Reads the secret, with its managed identity V-->>A: Current value
sequenceDiagram participant P0 as App participant P1 as App Configuration participant P2 as Key Vault P0->>P1: Read setting P1-->>P0: Reference P0->>P2: Read secret
Key point: Use Key Vault references.
Why the other options are wrong
- A. Put the secret in the app's display name
- That exposes the secret.
- C. Paste the secret value into the configuration
- That exposes the secret.
- D. Store the secret in a feature flag name
- That exposes the secret.