在Azure上存储ASP.NET Core应用程序密码的最佳方法

Question

I have developed some application and I am using there a external service to send emails (SendGrid). To use this service I need login and password to use SendGrid api. In developmnet environment I have used .Net Core secrets ( https://docs.microsoft.com/pl-pl/aspnet/core/security/app-secrets?view=aspnetcore-2.2&tabs=windows ) but now after publish I need to deliver login and password in other way. I know that there is a Azure Key Vault, but what if app will be published somwhere else?

Answer 1

FOR PRODUCTION: Use Managed Identity for Azure Resources to avoid storing connection strings. It is a clean solution for managing secrets in Key Vault.

Access Key for Key Vault or other similar resources is never shared, not even to Services or DevOps Engineer to deploy or run the applications in production

1. Create a Azure Key Vault and store your secrets
2. Enable System Managed Identity in your Azure App Service. It will register your web application at AAD internally
3. Search for Managed Service Identity Application ID at Key Vault and allow intended access to it
4. Initialize connection to your Key Vault by following snippet

Program.cs

using Microsoft.Azure.Services.AppAuthentication;
using Microsoft.Azure.KeyVault;
using Microsoft.Extensions.Configuration.AzureKeyVault;

...

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
    WebHost.CreateDefaultBuilder(args)
        .ConfigureAppConfiguration((context, config) =>
        {
            if (context.HostingEnvironment.IsProduction())
            {
                var builtConfig = config.Build();

                var azureServiceTokenProvider = new AzureServiceTokenProvider();
                var keyVaultClient = new KeyVaultClient(
                    new KeyVaultClient.AuthenticationCallback(
                        azureServiceTokenProvider.KeyVaultTokenCallback));

                config.AddAzureKeyVault(
                    $"https://{builtConfig["KeyVaultName"]}.vault.azure.net/",
                    keyVaultClient,
                    new DefaultKeyVaultSecretManager());
            }
        })
        .UseStartup<Startup>();

Startup.cs

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }
}

5. Now, secrets from Key Vault will be loaded into Configuration variable. You can use it like, Configuration["YourKeyVaultKeyName"].

FOR DEVELOPMENT: You can optionally use Dotnet-user-secrets tool to store\\ manage the secrets in local machine.