A secret must be changed on a schedule with little disruption. What should you set up?
Why D is the answer
Rotation in Key Vault, with apps reading the current version
Rotation in Key Vault replaces a secret on schedule. Apps should fetch secrets at run time rather than baking them in.
In detail
- Key Vault rotation changes the secret.
- Apps read the current version.
- Avoid pinning a specific secret version.
Use case
An illustrative scenario, not a real incident.
A database password changes each quarter. Key Vault rotation updates it, and apps read the current version.
See it in different ways
sequenceDiagram participant A as App participant C as App Configuration participant V as Key Vault A->>C: Reads settings and flags C-->>A: Key Vault reference A->>V: Reads the secret, with its managed identity V-->>A: Current value
stateDiagram-v2 state "Version 1 in use" as s0 state "Version 2 created" as s1 state "Apps read version 2" as s2 state "Version 1 removed" as s3 [*] --> s0 s0 --> s1: rotate s1 --> s2 s2 --> s3 s3 --> [*]
Key point: Rotate in Key Vault, and read the current version.
Why the other options are wrong
- A. A new container image for every rotation of the secret
- New images add needless deployments.
- B. A reminder for a person to edit each app by hand
- Hand edits are error prone.
- C. A longer secret value that never needs to change
- Long secrets still need rotation.