Azure Key Vault

• Name: Azure Key Vault
• Category: Secret manager

​

Configuration

​

Limitations

• Deleted configs do not immediately remove secrets due to soft deletion. Attempting to upsert to a deleted secret that is not purged will throw an error.

​

Usage

​

.configu store declaration

stores:
  my-store:
    type: azure-key-vault
    configuration:
      credential: {}
      vaultUrl: https://my-vault.vault.azure.net/

​

CLI Examples

​

Upsert Command

configu upsert --store "my-store" --set "test" --schema "./start.cfgu.json" \
    -c "GREETING=hey" \
    -c "SUBJECT=configu"

​

Eval and export commands

configu eval --store "my-store" --set "test" --schema "./start.cfgu.json" \
 | configu export

​

Common errors and solutions

1. Authentication failure
   • Solution: Ensure the correct clientId, clientSecret, and tenantId are provided. Verify the service principal’s permissions in the Azure portal.
2. Vault not found
   • Solution: Ensure the vaultUrl is correct and the key vault exists in your Azure subscription. Verify with:
     az keyvault show --name my-vault
     
3. Access denied
   • Solution: Make sure the service principal has the necessary access policy to manage secrets. Use the following command to grant permissions:
     az keyvault set-policy --name my-vault --spn <your-client-id> --secret-permissions get list set delete
     
4. Network connectivity issues
   • Solution: Verify that your network allows access to the vault endpoint. Test the connectivity with:
     curl -I https://my-vault.vault.azure.net/
     

​

References

• Integration documentation: https://docs.aws.amazon.com/secretsmanager
• Azure Identity SDK: https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-v2-libraries