Search code examples
.netsecurityazureconfigurationconnection-string

How to properly store connection strings in Azure?

SQL azure connection strings always include a password (as Azure SQL Server doesn't support OS authentication) which makes it unsafe to keep them in web.config files. A typical recommendation you can find on the net is to move them to cloud configuration settings which means declaring a setting in ServiceDefinition/WebRole/ConfigurationSettings section of ServiceDefinition.csdef file so that you can edit them in the portal:

enter image description here

The problem with this approach is whenever you re-deploy your site the settings you set in the portal get overriden with what values are in ServiceConfiguration.*.cscfg. Of course, you can put your connection strings to the file but that's pointless as you still keep the secrets in a source control.

Azure Key Vault could be a good solution here but I'd like to explore other options before going this route. What would you recommend?

Solution

  • Create managed identities for your service and use key vault to add the access policy to key vault. No need to store client secret and all the configuration is stored in secured way.