azure - 如何安全地存储连接字符串客户端 ID 等？

Question

让我提供一些设置细节

我正在构建一个托管在 Azure 上的 asp.net core API 应用程序。我将我的 key 和其他东西存储在 azure keyvault 中。但是，我有一些 AzureAddClientId 和 key ，现在存储在 appsettings.json 中(用于访问 key 保管库)。我还将 appsettings.json 提交到我的 git 存储库。但我知道这是不安全的。我使用 Azure DevOps 进行发布。所以我正在考虑做以下事情。请让我知道您对此的想法。

1. 将 appsettings.json 添加到 gitignore 并在开发人员之间共享该文件。
2. 将 AzureAddClientId 和 AzureAADClientSecret 作为变量添加到 azure DevOps 构建管道。 (devops 会自动获取变量，就像它们在 appsettings.json 中一样吗？)

Answer 1

请查看使用Managed Identities .

A common challenge when building cloud applications is how to manage the credentials in your code for authenticating to cloud services. Keeping the credentials secure is an important task. Ideally, the credentials never appear on developer workstations and aren't checked into source control. Azure Key Vault provides a way to securely store credentials, secrets, and other keys, but your code has to authenticate to Key Vault to retrieve them.

The managed identities for Azure resources feature in Azure Active Directory (Azure AD) solves this problem. The feature provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.