Key Vault Integration
Secure key management is essential to protect data in the cloud. Use Azure Key Vault to encrypt keys and small secrets like passwords and share it securely to the application with Zero trust.
Create Key Vault
Select the option ‘Create a resource’ from Azure home page
Search for the resource type ‘Key vault’ in Azure Marketplace and select the service ‘Key Vault by Microsoft’ from the results
Click on ‘Create’
In Basics tab, select the same Subscription, Resource Group and Region as the pre-existing Inforiver deployment and give a valid name for key vault
Under Access policy tab, you could either choose ‘Vault access policy’ or ‘Azure RBAC’ as permission model. In this guide we are going with ‘Vault access policy’ and make sure you have proper rights under ‘Access policies’
In Networking, Uncheck the option ‘Enable public access’ and create a private endpoint in the ‘private’ subnet of the Inforiver VNet with private DNS Zone enabled
Validate everything and click on Create
Once completed, you should see 3 new resources added to the Inforiver Resource group
Configure Key Vault
From Inforiver App service, enable ‘System assigned managed Identity’ and save. Copy the created object ID, this will be used to assign permissions on Key vault to get secrets
From Key Vault, Create a new access policy
Under ‘Permissions’ tab, select ‘Secret Management’ as template and choose only ‘List’ and ‘Get’ in ‘Secret permissions’
Under Principal tab, search using the copied object ID and select the listed principal
Validate everything and create
Enable Public access for Key vault temporarily to create secrets
From App service configuration page, copy each confidential environment variable’s name and value then create them as secrets in Key vault
Key vault secret names cannot contain special characters, so you need to remove the underscores in the name. For example: ‘SMTP_API_KEY’ will need to be changed into ‘SMTPAPIKEY’
We recommend creating these listed secrets in Key vault
Configure App Service
Once you have created (copied from app service) all the secrets, you need to change the app configuration values to reference the key vault secrets instead of direct plain text passwords. Reference example: @Microsoft.KeyVault(SecretUri=https://.vault.azure.net/secrets//)
Editing App Service Environment values
Making sure that every secret is updated with key vault reference and then click on Save
Please note that clicking on ‘Continue’ here will restart the app service
Check if the app restart is successful and you can login to Inforiver
Finally, disable the ‘Public access’ in Key vault and restart the app service once again to validate if the app service could connect to it using private endpoint
Validate in Inforiver management portal, metrics tab that everything works and green.
Last updated
