search

Azure / api-management-policy-snippets

Re-usable examples of Azure API Management policies
MIT License
341 stars 155 forks source link

Adding example for Key Vault with Managed Identity #30

Closed nzthiago closed 5 years ago

nzthiago commented 5 years ago

Adds a policy example for using Managed Identities to look up secrets stored in Key Vault. The Managed Identity is used to authenticate with Key Vault.

tomkerkhove commented 5 years ago

The example looks good but I think the approach should be changed. Now we show that it's ok to leak secrets to externals, but maybe we should create an example that:

  1. Gets API key from Key Vault
  2. Calls API with Key
  3. Returns response

Example could be to get all GitHub repos in an org for example.

That said, good example that shows how simple it is!

nzthiago commented 5 years ago

We needed a super simple one that focused on how to get the secret from Key Vault with MSI and not on what to do with the secret, so I wouldn't change this one. I do agree that we can now build on it to show what to do with the secret, sounds like you're volunteering to add one for GitHub API :)

tomkerkhove commented 5 years ago

It's more about setting an example on how to do security right but I get what you are saying.

Do you mind if I just PR a quick note?

tomkerkhove commented 5 years ago

I do agree that we can now build on it to show what to do with the secret, sounds like you're volunteering to add one for GitHub API :)

I wish I had the time for that which is not the case, sorry! 😔

nzthiago commented 5 years ago

Sure, feel free to PR with the extra note, @miaojiang would be the one to merge it

tomkerkhove commented 5 years ago

Here we go! Let me know what you think if you're interested.

I want to clarify again that I have no problems with your sample @nzthiago! I just want to make people aware that they should not do this in PROD 😅

tomkerkhove commented 5 years ago

Don't thank me @vladvino, thank @nzthiago !