Azure Keyvault to access resources from different azure subscriptions

user_2921817 0
Viewed 7082

I am trying to use azure keyvault in my MVC application to get storage account keys. This MVC application is hosted in different azure subscriptions with storage accounts belonging to those subscriptions. Is it possible to have a one Azure Keyvault resource in any subscription and serve keys for storage accounts residing in different subscriptions?

azure-keyvault azure-storage azure
2 Answers

Yes it is possible.

You will need to make identities for the apps using the Key Vault in the Azure AD tenant where the Key Vault's subscription is. And then assign permissions to access the vault to those service principals.

Then you can put the client id, client secret and tenant id to the apps that need to access the Key Vault. They should then be able to call it, since they have an identity that is allowed access. Key Vault uses an HTTP API so whether the apps and the vault are in the same subscription/data center/cloud provider is irrelevant.

user_16589060

Hi you can use below to do via azure CLI

 az webapp config ssl import -n 'webappname' -g 'webappresourcegroup' --key-vault "/subscriptions/[provide subscriptionID]/resourceGroups/[Provide resource group Name]/providers/Microsoft.KeyVault/vaults/[Provide Vault Name] --key-vault-certificate 'Provide certificate Name'
user_162610580
Related