azure - 使用 Azure Key Vault 而不仅仅是应用程序配置有什么意义？

Question

使用 Azure Key Vault 而不是应用程序配置有什么意义吗？

是的，是的，我知道 - 它们是免费的， secret 的 keystore ，应用程序配置......好吧，应用程序配置。

但是，考虑到它们都是加密的，基本上，为了让某人看到 secret 或配置值，他们必须有权访问您的 azure 门户(这是一个低级坏人场景)。

我看到的唯一区别是，您可以在保管库和配置之间以不同的方式控制权限，但除此之外，如果未经授权的人可以访问您的门户，您就会遇到更大的问题。

那么 - 为什么？请只提出好的和真实的论点，而不是“因为你应该”或“因为 X 人这么说”，我可以使用 key 保管库获得哪些我在应用程序配置中没有的好处？

Answer 1

我很感激你的问题。我将其重新表述为:

问)Key Vault 和应用配置的设计有何不同，以支持不同的用途？我在哪里可以找到清晰的功能和优点比较表？

我也很欣赏你的旁白:

please only good and real arguments no "because you should" or"because person X said so", what benefits would I reap with key vaultthat I don't have with app config?

以下是我发现的对比优势:

第1条:What is Azure App Configuration?

App Configuration complements Azure Key Vault, which is used to store application secrets. App Configuration makes it easier to implement the following scenarios:

• Centralize management and distribution of hierarchical configuration data for different environments and geographies
• Dynamically change application settings without the need to redeploy or restart an application
• Control feature availability in real-time

<小时/>

第 2 条:Key management with Key Vault

Key management with Key Vault

Without proper protection and management of the keys, encryption is rendered useless. Key Vault is the Microsoft-recommended solution for managing and controlling access to encryption keys used by cloud services. Permissions to access keys can be assigned to services or to users through Azure Active Directory accounts.

Key Vault relieves organizations of the need to configure, patch, and maintain hardware security modules (HSMs) and key management software. When you use Key Vault, you maintain control. Microsoft never sees your keys, and applications don’t have direct access to them. You can also import or generate keys in HSMs.

<小时/>

第三条:Azure Key Vault recovery management with soft delete and purge protection

Soft delete and purge protection are two different key vault recovery features.