Search code examples
azureazure-data-factory

Use Azure Key Vault secret in Header section of Web Activity

I've been provided with API Endpoint URL and api key. Naturally, I don't want to store the original key in production pipeline, therefore I've asked to store it into secret in KeyVault. They have done that and I got my KV - lets name this secret API-KEY-sec. I am POSTing the data, and in headers I want to pass two parameters - Content-Type - application/json and Authorization - API-KEY-sec value but I struggle to manage to pass it. Tried to set https://[KeyVaultName].vault.azure.net/secrets/[SecretName]' as variable and give it as dynamic content to header Authorization parameter but it didnt work out. Any tips how to do that?

Solution

  • To Use Azure Key Vault secrets in pipeline activities you need to use web activity to fetch the secret and then use it in your required activity:

    To achieve that to need to first allow the ADF to read secret from key vault.

    • Copy the Managed Identity Application ID value from the data factory's properties and add the managed identity to Get and List secrets by opening the key vault access policies. enter image description here enter image description here

    • Go to your secret in key vault and copy Secret Identifier. enter image description here

    • Then in ADF take web activity get the secret value

    URL:        [Your secret URI value]?api-version=7.0 
example:    https://uytrewg.vault.azure.net/secrets/keyname/version?api-version=7.0
Method:     GET
Authentication: System Assigned Managed Identity
Resource:   https://vault.azure.net

    enter image description here

    Output:

    enter image description here

    Now, use this secret value as @activity('Web1').output.value in further activities