Question

A development team runs a web application on Azure App Service that must retrieve a database connection string and an external API key at runtime. Currently these secrets are stored as plaintext app settings, and security review flagged the risk. The architect must design a solution that eliminates stored credentials in application configuration and code, allows secrets to be centrally managed and rotated, and requires no code changes to how the application reads its configuration. Which approach best satisfies these requirements?

Accepted Answer

Store the secrets in Azure Key Vault, enable a system-assigned managed identity on the App Service, grant it get permissions on the vault, and configure the app settings as Key Vault references.

Answer

Store the secrets in Azure Key Vault and have the application authenticate to the vault at startup using a service principal client secret stored in an app setting.

Answer

Encrypt the connection string and API key with a customer-managed key in Key Vault and keep the encrypted values as app settings, decrypting them in application code.

Answer

Move the secrets into an Azure Storage account protected with a shared access signature and inject the SAS token into the App Service configuration.