Azure Key Vault

Overview

We set up Key Vault for the secrets, certificates, and keys the data platform uses. Access is Azure RBAC, rotation is agreed for anything that expires, and applications read secrets through a managed identity rather than a client secret stored beside the code.

We migrate existing passwords and connection strings out of pipeline JSON and app settings, and we turn on logging so a secret read can be traced. Soft-delete and purge protection are enabled before production secrets are stored.

What we deliver

• Key Vault with RBAC, soft-delete, and purge protection
• Secret and certificate inventory with owners and expiry dates
• Managed-identity access from pipelines, functions, and applications
• Diagnostic logs and an alert before a certificate expires

Business benefits

• Connection strings leave source code and pipeline definitions
• A secret read is attributable to an identity in the logs
• Certificates have an owner and an alert, not a surprise outage