Build: Create Key Vault and Store First Secret

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

Azure SubscriptionRequired
Key Vault requires a subscription
Azure CLIRequired
az login required
@azure/keyvault-secrets, @azure/identityRequired
npm install @azure/keyvault-secrets @azure/identity

🔒

Step 1 of 4

Create Key Vault and Store First Secret

Provision an Azure Key Vault with soft-delete and purge protection. Store a database connection string as the first secret.

Tasks

Create Key Vault: `az keyvault create --name myapp-kv --resource-group rg-myapp --sku standard --enable-purge-protection true`

Store a secret: `az keyvault secret set --vault-name myapp-kv --name DatabaseConnectionString --value "Server=prod-db;Password=..."`

Retrieve it: `az keyvault secret show --vault-name myapp-kv --name DatabaseConnectionString --query value -o tsv`

🎯 What You'll Learn

▸Understand Key Vault tier differences (Standard vs Premium)
▸Enable soft-delete and purge protection (compliance requirement)
▸Store and retrieve a secret via Azure CLI

Code

Bashcreate-keyvault.sh
1 #!/bin/bash
2 set -e
3  
4 VAULT_NAME="myapp-kv-${RANDOM}"
5 RG="rg-myapp"
6  
7 # Create Key Vault with security best practices
8 az keyvault create   --name "$VAULT_NAME"   --resource-group "$RG"   --sku standard   --enable-purge-protection true   --retention-days 90   --enable-rbac-authorization true  # Use RBAC instead of vault access policies
9  
10 echo "Key Vault created: $VAULT_NAME"
11 echo "VAULT_URL=https://$VAULT_NAME.vault.azure.net" >> .env.local
12

💡 Pro Tips

▸Purge protection prevents deletion of Key Vault for 7-90 days — required for HSM-backed keys and compliance certifications

Expected Output

Key Vault created; secret stored and retrievable via CLI

Discussion

1 #!/bin/bash 2 set -e 3 4 VAULT_NAME="myapp-kv-${RANDOM}" 5 RG="rg-myapp" 6 7 # Create Key Vault with security best practices 8 az keyvault create --name "$VAULT_NAME" --resource-group "$RG" --sku standard --enable-purge-protection true --retention-days 90 --enable-rbac-authorization true # Use RBAC instead of vault access policies 9 10 echo "Key Vault created: $VAULT_NAME" 11 echo "VAULT_URL=https://$VAULT_NAME.vault.azure.net" >> .env.local 12

1	#!/bin/bash
2	set -e
3
4	VAULT_NAME="myapp-kv-${RANDOM}"
5	RG="rg-myapp"
6
7	# Create Key Vault with security best practices
8	az keyvault create --name "$VAULT_NAME" --resource-group "$RG" --sku standard --enable-purge-protection true --retention-days 90 --enable-rbac-authorization true # Use RBAC instead of vault access policies
9
10	echo "Key Vault created: $VAULT_NAME"
11	echo "VAULT_URL=https://$VAULT_NAME.vault.azure.net" >> .env.local
12