<p>Assuming this is transient container then my suggestion to work around the not yet implemented issues would be that whatever creates it does so by passing in secure environment variables for the values you want from the key vault; then your scripts can access the data that way.</p>

<p>I'm not sure what your security considerations are so you'll need to take that into account so people can't login to the container to view the environment variables.</p>

<p>As an example I have a function that uses the .Net Fluent API to create a container group and then sets the environment variables for the container using ".WithEnvironmentVariablesWithSecuredValue()" this means anyone whose looking at the container in the portal won't be able to see the values in plain text.</p>

<p>Then you assign a managed identity to the function and then give that identity get permissions to secrets in the key vault and then you can either access the key vault in code in the function or the easier option is the put them as app settings for your function and then just get them as environment variables in your function - <a href="https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references</a> </p>

<p>Hope this helps or gives you an idea on a workaround?</p>

CC BY-SA 4.0
2020-01-14T23:26:44.540Z
2020-01-15T01:35:56.043Z
2020-01-15T01:35:56.043Z
Simon
<p>I am coming from AWS / Linux and try this in Azure / Windows, now.</p>

<p><strong>The Question:</strong></p>

<p>I have a windows container in Azure and want it to get some secrets from an Azure Vault. How can I do that?</p>

<p><strong>This is how I thought it would work (but didn't):</strong></p>

<p>I had expected that I could just run </p>

<p><code>az keyvault secret show --name "my_secret" --vault-name "my_fault"</code></p>

<p>... at least after adding permissions to the container. Unfortunately, I cannot find out how to add permissions to the container to access the vault. </p>

<p><strong>What I have tried so far:</strong></p>

<p>I have created the vault and added an "application" under "Access Policies". I do not find any way how to make the container act as the "application".</p>

<p>I have read that items need to get an "identity assigned" <a href="https://docs.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity" rel="nofollow noreferrer">1</a>, but this seems to be not supported with windows containers <a href="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities" rel="nofollow noreferrer">2</a>. I had tried it out before I found the documentation, and it did not work.</p>

<p>How can I access the azure key vault from an azure container?</p>

CC BY-SA 4.0
2020-01-14T22:15:01.163Z
What are you trying to run on the container or is it just a plain container with no apps as such and you're running the az commands from say PowerShell within the container?
Simon
CC BY-SA 4.0
2020-01-14T22:33:40.350Z
My plan was, to run test scripts within the container(s). Commands will be run via PowerShell; I will probably launch a ps script automatically after a container is launched.
hey
<containers><azure>
Azure Windows Container: How to read secrets from an azure vault
hey
# Azure Windows Container: How to read secrets from an azure vault

(Asked by: username_0 on 2020-01-13)

I am coming from AWS / Linux and try this in Azure / Windows, now.

**The Question:**

I have a windows container in Azure and want it to get some secrets from an Azure Vault. How can I do that?

**This is how I thought it would work (but didn't):**

I had expected that I could just run

`az keyvault secret show --name "my_secret" --vault-name "my_fault"`

... at least after adding permissions to the container. Unfortunately, I cannot find out how to add permissions to the container to access the vault.

**What I have tried so far:**

I have created the vault and added an "application" under "Access Policies". I do not find any way how to make the container act as the "application".

I have read that items need to get an "identity assigned" [1](https://docs.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity), but this seems to be not supported with windows containers [2](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities). I had tried it out before I found the documentation, and it did not work.

How can I access the azure key vault from an azure container?

**Tags:** containers, azure

> **Comments:**
> **username_1**: What are you trying to run on the container or is it just a plain container with no apps as such and you're running the az commands from say PowerShell within the container?  
> **username_0**: My plan was, to run test scripts within the container(s). Commands will be run via PowerShell; I will probably launch a ps script automatically after a container is launched.  

---

## 1 answers

### Answer by username_1 on 2020-01-14. Score: 1

Assuming this is transient container then my suggestion to work around the not yet implemented issues would be that whatever creates it does so by passing in secure environment variables for the values you want from the key vault; then your scripts can access the data that way.

I'm not sure what your security considerations are so you'll need to take that into account so people can't login to the container to view the environment variables.

As an example I have a function that uses the .Net Fluent API to create a container group and then sets the environment variables for the container using ".WithEnvironmentVariablesWithSecuredValue()" this means anyone whose looking at the container in the portal won't be able to see the values in plain text.

Then you assign a managed identity to the function and then give that identity get permissions to secrets in the key vault and then you can either access the key vault in code in the function or the easier option is the put them as app settings for your function and then just get them as environment variables in your function - <https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references>

Hope this helps or gives you an idea on a workaround?


---

