From the course: Microsoft Azure Cosmos DB Developer Specialty (DP-420) Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 24,800 courses taught by industry experts.

Manage account keys by using Azure Key Vault

Manage account keys by using Azure Key Vault

From the course: Microsoft Azure Cosmos DB Developer Specialty (DP-420) Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Manage account keys by using Azure Key Vault

“

- [Instructor] How do we secure those Cosmos DB read, write, and read-only keys? Well, you can disable 'em at deployment like I mentioned before, but after that you can store 'em in Key Vault and then give access to them selectively through the Key Vault APIs. You can create a system-assigned managed identity to represent your Cosmos account. That means you can, with a couple mouse clicks, configure an identity in your Azure AD tenant for the Cosmos DB account. Why is that important? Because then you can give Cosmos DB keys to Key Vault, and they're stored as secrets, and then you can give Cosmos DB permission to read out of the Key Vault, and that way you're accomplishing a couple of tasks. Number one, you're putting some additional security and governance on those sensitive keys. Hopefully you also have a key regeneration and rotation strategy as well. And number two, what you're doing is that you're ensuring that…

Contents