Managing Azure Secrets in Python. Key Vault vs. App Configuration

Introduction

In modern cloud applications, managing secrets and configurations securely and efficiently is crucial. This post explores my journey leveraging Azure Key Vault and Azure App Configuration to handle secrets and settings in a Python application developed in Visual Studio Code. I’ll share the challenges encountered and insights gained, particularly when interfacing these Azure services with Python.

Setup and Initial Strategy

Our approach involves storing all sensitive information, like API keys and passwords, in Azure Key Vault, while other configurations reside in Azure App Configuration. The intended workflow is straightforward in C# due to the native libraries bridging Azure Key Vault and the App Configuration Service in way that could allow the client application to look for all the secrets and settings just in the App Cofiguration without referencig the Key Vault directlyt. However, replicating this in Python posed unique challenges.

Challenges in Python and Visual Studio Code

1. Azure Key Vault Integration:

• The primary hurdle was establishing a connection from local Python code in Visual Studio Code to Azure Key Vault. Unlike Visual Studio, which provides a built-in Azure authentication method, Visual Studio Code requires a distinct approach.
• The most reliable method I found was using Azure CLI. By logging in through CLI with the appropriate Azure account, Visual Studio Code could utilize the generated local credentials to access Azure Key Vault.

2. Using Azure App Configuration as an Intermediary:

• When attempting to use Azure App Configuration as a middleman to retrieve secret values stored as references in Key Vault, I discovered that it only fetched the URL of the secret, not the actual secret value itself. This is a significant deviation from the behavior observed in C#, where the secret value is directly retrievable.

Recommendations and Conclusion

For Python developers working with Azure services in Visual Studio Code, it is more practical to directly interface with Azure Key Vault for secret retrieval:

• Avoid using Azure App Configuration as an intermediary for secret management due to its limitation in fetching actual secret values.
• Utilize Azure CLI for authenticating Python code against Azure Key Vault, ensuring seamless access to the secrets.
• Directly access secrets from Azure Key Vault when needed, bypassing any unnecessary complications introduced by using Azure App Configuration as a go-between.
• All the other settings could be accessed directly from the App Configuration Service

Final Thoughts

While Azure offers robust solutions for secret and configuration management, developers must carefully choose the right tools and methods, especially when working across different programming environments and languages.