search

quarkiverse / quarkus-azure-services

Quarkus extensions for Azure services
Apache License 2.0
13 stars 17 forks source link

Azure blob documentation should not (sort of) recommend storing keys in source control #249

Open holly-cummins opened 1 week ago

holly-cummins commented 1 week ago

https://docs.quarkiverse.io/quarkus-azure-services/dev/quarkus-azure-storage-blob.html has the following instructions for configuring storage:

Then, in the application.properties file, add the following property:

quarkus.azure.storage.blob.connection-string=DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=stquarkusazurestorageblo;AccountKey=xxxxxxx==;BlobEndpoint=https://stquarkusazurestorageblo.blob.core.windows.net/;FileEndpoint=https://stquarkusazurestorageblo.file.core.windows.net/;QueueEndpoint=https://stquarkusazurestorageblo.queue.core.windows.net/;TableEndpoint=https://stquarkusazurestorageblo.table.core.windows.net/

I wonder if the instructions should instead suggest setting the QUARKUS_AZURE_STORAGE_BLOB_CONNECTION_STRING, so there's no risk of committing the connection string to source control? They could even explain that it can be set either in application.properties or as an environment variable, but environment variable is more secure for this kind of information.

I'd also suggest being explicit that the given string is an example, and the whole connection string is copy-pasted from either the cli or web console. Otherwise people might wonder why they have to set a configuration property, if the docs already know what the value is.