Securing Secrets with Azure Key Vault

It is widely known that storing credentials, connection strings, and other sensitive secrets in application code is not a good idea. Secrets get leaked all the time, and there are many tools integrated into code repositories nowadays that warn you if potential secrets are detected within your source code.

Azure Key Vault provides a way to store your application secrets, create and control encryption keys, and manage both public and private certificates centrally and securely. With the Standard tier, your keys, secrets, and certificates are software protected and safeguarded by Azure. With the Premium tier, you have the option to import or generate keys in hardware security modules (HSMs) that never leave the HSM boundary.

A key vault is a logical group of secrets, and as such the recommendation is to use one vault per application per environment (dev/prod, for example). This helps prevent the sharing of secret stores across different environments...