Is there a way to have shared secrets between two Azure Key vaults?

Sushant Pachipulusu 0
Viewed 32

As part of our data pipeline development my team maintains separate key vaults as scoped secret vaults for different regions of Azure Databricks. Now comes a situation where we need to maintain a specific configuration secret in both the Key Vaults and make sure that they are always in sync. Is there a way to have a shared secret between 2 Azure Key vaults in same subscription apart from maintaining a CI/CD through the same repo?

Below is sample illustration of how things are:

  • Key vault 'KV-EUS' connects to Databricks instance 'DB-EUS' with the scope name of 'Scope-X'
  • Key vault 'KV-WUS' connects to Databricks instance 'DB-WUS' with the scope name of 'Scope-X'

Note: I cannot change the design of the Key Vaults and Databricks connection, the reason I cannot attach 'KV-EUS' to 'DB-WUS' (or vice-versa) is because the code is written so that it expects the scope to be named 'Scope-X' in any Databricks instance. These changes are doable but not in the given timeframe

azure-keyvault azure-databricks databricks azure
1 Answers

You could use a pipeline in Azure DevOps or an Azure Automation Runbook to run this PowerShell code. Note that Key Vault backup and restore can happen cross region (e.g. East US to West US) but not cross geography (e.g. US to Europe) so you should be fine in your scenario.

GregGalloway0
Related