How to Store Secrets Securely in Azure
Introduction
Storing secrets securely is crucial in any cloud application. Azure provides multiple ways to store secrets like OAuth client secrets, API keys, connection strings, and certificates using services such as Azure Key Vault, API Management (APIM), and Function Apps.
1. Using APIM for Internal Secret Storage
APIM can store secrets securely for backend operations. These secrets are encrypted internally and never exposed to frontend users or API consumers.
- Secrets are encrypted at rest inside APIM.
- They are only used at runtime to request tokens or authenticate backend calls.
- APIM does not show secrets in logs or responses.
Practical Steps to Store a Secret in APIM
- Sign in to the Azure Portal.
- Go to API Management (APIM) and select your instance.
- Navigate to Named Values (sometimes called “Properties” or “Secrets”).
- Click + Add to create a new secret.
- Enter a Name for your secret (for example, OAuthClientSecret).
- Paste the Value of the secret.
- Enable Secret checkbox to make sure it is encrypted and hidden.
- Click Create to save it.
- Use this named value in your APIM policies to authenticate API calls securely.
Example: You have a client secret for a third-party OAuth service. Instead of putting it directly in your API policy, you store it as a named value in APIM called OAuthClientSecret. When your API calls the OAuth service, it references this named value securely.
2. Using Azure Key Vault
Azure Key Vault provides centralized secret management:
- Secure storage with encryption and access control.
- Secrets can be rotated automatically.
- APIM, Function Apps, and other Azure services can reference secrets using Managed Identity.
<set-variable name="clientSecret" value="@Microsoft.KeyVault(SecretUri=https://your-keyvault.vault.azure.net/secrets/ClientSecret)" />
3. Storing Connection Strings and Certificates
- Use Key Vault or Azure App Settings (with encryption) for Function Apps or Web Apps.
- Certificates for TLS or client authentication should always be in Key Vault.
4. Best Practices
- Always prefer Key Vault for sensitive secrets.
- Enable secret rotation and update references dynamically.
- Restrict access with RBAC and audit regularly.
- Never expose secrets in frontend apps or logs.
Next Steps
FAQ – Secure Secrets in Azure
What is the safest way to store secrets in Azure?
Use Azure Key Vault with proper access control and reference secrets dynamically in services like APIM or Function Apps.
Can APIM store secrets securely?
Yes, APIM encrypts secrets internally and can reference Key Vault for higher security.
How to store connection strings securely?
Use Azure Key Vault or App Settings in Function Apps/Web Apps with encryption and restricted access.
Can secrets be rotated automatically?
Yes, using Key Vault, secrets can be rotated automatically and referenced dynamically.
What is Managed Identity in Azure?
Managed Identity allows Azure services to access Key Vault securely without storing credentials.
Are secrets encrypted in APIM?
Yes, all secrets stored internally in APIM are encrypted at rest.
What types of secrets can be stored securely?
OAuth client secrets, API keys, connection strings, certificates, and other sensitive data.
Why use Key Vault for secrets?
Key Vault provides centralized management, access control, secret rotation, and compliance.
Do backend services see APIM secrets?
No, backend services only receive tokens or processed credentials, not the raw secret.
How to audit secret usage?
Use Key Vault logs and monitoring in APIM/Function Apps to track secret usage.
How to store a secret in Azure Key Vault (Practical Steps)?
1. Sign in to Azure Portal.
2. Search for Key Vault and select it.
3. Open your Key Vault and go to Secrets.
4. Click + Generate/Import.
5. Enter a name and value for your secret.
6. Click Create.
7. Reference the secret in APIM or Function Apps using the secret URI.
8. Use Managed Identity for secure access.
2. Search for Key Vault and select it.
3. Open your Key Vault and go to Secrets.
4. Click + Generate/Import.
5. Enter a name and value for your secret.
6. Click Create.
7. Reference the secret in APIM or Function Apps using the secret URI.
8. Use Managed Identity for secure access.