Azure Windows Container: How to read secrets from an azure vault

Question

I am coming from AWS / Linux and try this in Azure / Windows, now.

The Question:

I have a windows container in Azure and want it to get some secrets from an Azure Vault. How can I do that?

This is how I thought it would work (but didn't):

I had expected that I could just run

az keyvault secret show --name "my_secret" --vault-name "my_fault"

... at least after adding permissions to the container. Unfortunately, I cannot find out how to add permissions to the container to access the vault.

What I have tried so far:

I have created the vault and added an "application" under "Access Policies". I do not find any way how to make the container act as the "application".

I have read that items need to get an "identity assigned" 1, but this seems to be not supported with windows containers 2. I had tried it out before I found the documentation, and it did not work.

How can I access the azure key vault from an azure container?

Answer 1

Assuming this is transient container then my suggestion to work around the not yet implemented issues would be that whatever creates it does so by passing in secure environment variables for the values you want from the key vault; then your scripts can access the data that way.

I'm not sure what your security considerations are so you'll need to take that into account so people can't login to the container to view the environment variables.

As an example I have a function that uses the .Net Fluent API to create a container group and then sets the environment variables for the container using ".WithEnvironmentVariablesWithSecuredValue()" this means anyone whose looking at the container in the portal won't be able to see the values in plain text.

Then you assign a managed identity to the function and then give that identity get permissions to secrets in the key vault and then you can either access the key vault in code in the function or the easier option is the put them as app settings for your function and then just get them as environment variables in your function - https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

Hope this helps or gives you an idea on a workaround?