Is there a way to access Azure keyvault secrets from sitecore site

Question

I have some secrets stored in azure keyvault.

Using the following code, I was able to get the secret values via a console application.

using System.Management.Automation;

 Collection<PSObject> result = PowerShell.Create().AddScript("az keyvault secret show --name 'yyyyy' --vault-name 'zzzz' --query 'value'").Invoke();

when I deploy the same to Sitecore site(by adding to the class library), I see it never gets the result, it's always empty.

Tested this both in the local Sitecore site( by adding clienID, client secret, tenantId) to environment variables and also in the azure app by enabling managed identity.

Any thoughts on what needs to be done to make this work in sitecore site?

Answer 1

you should give Sitecore webapp the access to your keyvault. We have ours in the same Resource Group too. I used the following code sample from Github (hopefully this will help some).

https://github.com/Azure-Samples/app-service-msi-keyvault-dotnet/blob/master/WebAppKeyVault/WebAppKeyVault/Controllers/HomeController.cs

Better solution: Leverage the Azure functions to get the keyvault value from your app service. This is how we are implementing it now. Gives us a reuseable function that many other app can use.

Answer 2

Try this one.

using Azure;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets; 

var secretClient = new SecretClient(new Uri("<URL of Key Vault>"), new DefaultAzureCredential());
    
Response<KeyVaultSecret> secret = await secretClient.GetSecretAsync("Key vault key");
var keyValue = secret.Value;