Skip to content

🔐 Azure Key Vault – Full Creation + Access Workflows

🔴 STEP 0: COMMON SETUP (ONCE)

Prerequisites

  • Azure Subscription
  • Azure CLI installed
  • Logged in to Azure
az login
az account set --subscription <SUBSCRIPTION_ID>

1️⃣ CREATE RESOURCE GROUP

az group create \
  --name RaidenLabs-Website \
  --location centralindia

2️⃣ CREATE AZURE KEY VAULT (RBAC MODE)

az keyvault create \
  --name raidenlabs-kv \
  --resource-group RaidenLabs-Website \
  --location centralindia \
  --enable-rbac-authorization true

✔ Uses Azure RBAC (recommended) ✔ Centralized permission model

3️⃣ CREATE A SECRET

az keyvault secret set \
  --vault-name raidenlabs-kv \
  --name DB-CONNECTION-STRING \
  --value "mongodb://raidenUser:p@ssW0rd123@db01.mongo.cloud:27017/raidenDB"

🔑 ACCESS METHODS — FULL WORKFLOWS

1️⃣ AZURE PORTAL (Console / UI)

Workflow

Azure AD User
 → Assigned KV Role
 → Azure Portal
 → Read Secret

Steps

  1. Assign role:
az role assignment create \
  --assignee <USER_OBJECT_ID> \
  --role "Key Vault Secrets Officer" \
  --scope <KEY_VAULT_ID>
  1. Portal → Key Vault → Secrets → Show value

2️⃣ AZURE CLI (User Login)

Workflow

User → az login
 → Azure AD Token
 → RBAC check
 → Secret returned

Steps

az login

az keyvault secret show \
  --vault-name raidenlabs-kv \
  --name DB-CONNECTION-STRING \
  --query value -o tsv

3️⃣ MANAGED IDENTITY (INSIDE AZURE – BEST)

Workflow

Azure Service
 → Managed Identity
 → Azure AD
 → RBAC
 → Key Vault

Steps

Enable Managed Identity

az webapp identity assign \
  --name raiden-backend-app \
  --resource-group RaidenLabs-Website

Grant access

az role assignment create \
  --assignee <PRINCIPAL_ID> \
  --role "Key Vault Secrets User" \
  --scope <KEY_VAULT_ID>

Access (App Setting)

DB_CONNECTION_STRING=@Microsoft.KeyVault(SecretUri=https://raidenlabs-kv.vault.azure.net/secrets/DB-CONNECTION-STRING/)

In Code

process.env.DB_CONNECTION_STRING

4️⃣ AZURE SDKs (APPLICATION CODE)

Workflow

App Code
 → DefaultAzureCredential
 → (MSI / CLI / SP / OIDC)
 → Key Vault

Steps

npm install @azure/identity @azure/keyvault-secrets

import { DefaultAzureCredential } from "@azure/identity";
import { SecretClient } from "@azure/keyvault-secrets";

const client = new SecretClient(
  "https://raidenlabs-kv.vault.azure.net",
  new DefaultAzureCredential()
);

const secret = await client.getSecret("DB-CONNECTION-STRING");
console.log(secret.value);

5️⃣ SERVICE PRINCIPAL (CLIENT ID + SECRET)

Workflow

Service Principal
 → Client Secret
 → Azure AD
 → RBAC
 → Key Vault

Steps

Create SP

az ad sp create-for-rbac \
  --name raiden-kv-sp \
  --role "Key Vault Secrets User" \
  --scopes <KEY_VAULT_ID>

Export creds

export AZURE_CLIENT_ID=11111111-aaaa-bbbb-cccc-222222222222
export AZURE_CLIENT_SECRET=spSecretXyZ987654
export AZURE_TENANT_ID=33333333-dddd-eeee-ffff-444444444444

Access

az keyvault secret show \
  --vault-name raidenlabs-kv \
  --name DB-CONNECTION-STRING

Workflow

CI Job
 → OIDC Token
 → Azure AD
 → Role Check
 → Key Vault

Steps

Create App Registration

az ad app create --display-name raiden-kv-oidc

Add Federated Credential (GitHub)

{
  "issuer": "https://token.actions.githubusercontent.com",
  "subject": "repo:raidenlabs/backend:ref:refs/heads/main",
  "audiences": ["api://AzureADTokenExchange"]
}

GitHub Action

permissions:
  id-token: write

steps:
- uses: azure/login@v1
  with:
    client-id: 55555555-aaaa-bbbb-cccc-666666666666
    tenant-id: 77777777-dddd-eeee-ffff-888888888888
    subscription-id: 99999999-1111-2222-3333-444444444444

- run: |
    az keyvault secret show \
      --vault-name raidenlabs-kv \
      --name DB-CONNECTION-STRING

7️⃣ ENVIRONMENT VARIABLE (KEY VAULT REFERENCE)

Workflow

App Service
 → Managed Identity
 → Key Vault
 → Inject as ENV

Steps

az webapp config appsettings set \
  --name raiden-backend-app \
  --resource-group RaidenLabs-Website \
  --settings \
  DB_CONNECTION_STRING="@Microsoft.KeyVault(SecretUri=https://raidenlabs-kv.vault.azure.net/secrets/DB-CONNECTION-STRING/)"

process.env.DB_CONNECTION_STRING

8️⃣ AZURE VM / AKS (WORKLOAD IDENTITY)

Workflow

VM / Pod
 → Managed / Workload Identity
 → Azure AD
 → Key Vault

Steps (VM)

az vm identity assign \
  --name raiden-vm \
  --resource-group RaidenLabs-Website

az keyvault secret show \
  --vault-name raidenlabs-kv \
  --name DB-CONNECTION-STRING

9️⃣ THIRD-PARTY TOOLS (Terraform)

Workflow

Terraform
 → Azure Auth (CLI / SP / OIDC)
 → Key Vault

Steps

data "azurerm_key_vault_secret" "db" {
  name         = "DB-CONNECTION-STRING"
  key_vault_id = "/subscriptions/xxx/resourceGroups/RaidenLabs-Website/providers/Microsoft.KeyVault/vaults/raidenlabs-kv"
}

🧠 FINAL MENTAL MODEL (VERY IMPORTANT)

IDENTITY
  ↓
AUTHENTICATION (Azure AD)
  ↓
AUTHORIZATION (RBAC)
  ↓
AZURE KEY VAULT
  ↓
SECRET

✅ REAL-WORLD RECOMMENDATION

Environment Method
Local Dev Azure CLI
Azure App Managed Identity
CI/CD OIDC
Automation OIDC
Emergency Portal
Legacy Service Principal

Here are the exact Azure CLI commands to delete a secret and delete the Key Vault, plus recover / purge (very important because of soft delete).

🔐 Azure Key Vault – Delete & Cleanup Commands

1️⃣ Delete a Secret (Soft-Deleted)

az keyvault secret delete \
  --vault-name azure-SAL-kv \
  --name DB-CONNECTION-STRING

Verify deleted secrets

az keyvault secret list-deleted \
  --vault-name azure-SAL-kv \
  -o table

♻️ Recover a Deleted Secret (If Needed)

az keyvault secret recover \
  --vault-name azure-SAL-kv \
  --name DB-CONNECTION-STRING

🔥 Permanently Delete (Purge) a Secret

az keyvault secret purge \
  --vault-name azure-SAL-kv \
  --name DB-CONNECTION-STRING

⚠️ Irreversible ⚠️ Requires Purge permission

2️⃣ Delete the Key Vault (Soft-Deleted)

az keyvault delete \
  --name azure-SAL-kv \
  --resource-group azure-solution-architect-labs

This soft-deletes the vault.

♻️ Recover the Deleted Key Vault

az keyvault recover \
  --name azure-SAL-kv

🔥 Permanently Delete (Purge) the Key Vault

az keyvault purge \
  --name azure-SAL-kv \
  --location eastus

⚠️ Required when:

  • Re-creating a vault with the same name
  • Cleaning up labs

🧠 VERY IMPORTANT NOTES

Soft Delete Rules

  • Always enabled
  • Applies to secrets, keys, certs, and vaults

Purge Protection

  • ❌ Disabled → Purge allowed
  • ✅ Enabled → Purge blocked until retention ends

✅ QUICK CHEAT SHEET

Action Command
Delete secret az keyvault secret delete
Recover secret az keyvault secret recover
Purge secret az keyvault secret purge
Delete vault az keyvault delete
Recover vault az keyvault recover
Purge vault az keyvault purge

📋 View in Table Format (Quick Check)

az keyvault show \
  --name azure-SAL-kv \
  --resource-group azure-solution-architect-labs \
  -o table