You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/key-vault/secrets/tutorial-rotation.md
+14-12Lines changed: 14 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ tags: 'rotation'
8
8
ms.service: key-vault
9
9
ms.subservice: secrets
10
10
ms.topic: tutorial
11
-
ms.date: 01/26/2020
11
+
ms.date: 01/20/2023
12
12
ms.author: mbaldwin
13
13
ms.devlang: csharp
14
14
ms.custom: devx-track-csharp
@@ -20,7 +20,6 @@ The best way to authenticate to Azure services is by using a [managed identity](
20
20
21
21
This tutorial shows how to automate the periodic rotation of secrets for databases and services that use one set of authentication credentials. Specifically, this tutorial rotates SQL Server passwords stored in Azure Key Vault by using a function triggered by Azure Event Grid notification:
22
22
23
-
24
23
:::image type="content" source="../media/rotate-1.png" alt-text="Diagram of rotation solution":::
25
24
26
25
1. Thirty days before the expiration date of a secret, Key Vault publishes the "near expiry" event to Event Grid.
@@ -38,12 +37,12 @@ This tutorial shows how to automate the periodic rotation of secrets for databas
38
37
* Azure Key Vault
39
38
* SQL Server
40
39
41
-
Below deployment link can be used, if you don't have existing Key Vault and SQL Server:
40
+
If you don't have existing Key Vault and SQL Server, you can use this deployment link:
42
41
43
42
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FKeyVault-Rotation-SQLPassword-Csharp%2Fmain%2FARM-Templates%2FInitial-Setup%2Fazuredeploy.json)
44
43
45
44
1. Under **Resource group**, select **Create new**. Give group a name, we use **akvrotation** in this tutorial.
46
-
1. Under **Sql Admin Login**, type Sql administrator login name.
45
+
1. Under **SQL Admin Login**, type SQL administrator login name.
## Create and deploy sql server password rotation function
69
+
## Create and deploy SQL server password rotation function
70
+
71
71
> [!IMPORTANT]
72
-
> Below template requires Key Vault, SQL server and Azure Function to be in the same resource group
72
+
> This template requires the key vault, SQL server and Azure Function to be in the same resource group.
73
73
74
-
Next, create a function app with a system-managed identity, in addition to the other required components, and deploy sql server password rotation functions
74
+
Next, create a function app with a system-managed identity, in addition to the other required components, and deploy SQL server password rotation functions
75
75
76
76
The function app requires these components:
77
77
- An Azure App Service plan
78
-
- A Function App with Sql password rotation functions with event trigger and http trigger
78
+
- A Function App with SQL password rotation functions with event trigger and http trigger
79
79
- A storage account required for function app trigger management
80
80
- An access policy for Function App identity to access secrets in Key Vault
81
-
- An EventGrid event subscription for **SecretNearExpiry** event
81
+
- An Event Grid event subscription for **SecretNearExpiry** event
82
82
83
-
1. Select the Azure template deployment link:
83
+
1. Select the Azure template deployment link:
84
84
85
85
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FKeyVault-Rotation-SQLPassword-Csharp%2Fmain%2FARM-Templates%2FFunction%2Fazuredeploy.json)
86
86
87
87
1. In the **Resource group** list, select **akvrotation**.
88
-
1. In the **Sql Server Name**, type the Sql Server name with password to rotate
88
+
1. In the **SQL Server Name**, type the SQL Server name with password to rotate
89
89
1. In the **Key Vault Name**, type the key vault name
90
90
1. In the **Function App Name**, type the function app name
91
91
1. In the **Secret Name**, type secret name where the password will be stored
@@ -191,6 +191,7 @@ This rotation method reads database information from the secret, creates a new v
191
191
You can find the complete code on [GitHub](https://github.com/Azure-Samples/KeyVault-Rotation-SQLPassword-Csharp).
192
192
193
193
## Add the secret to Key Vault
194
+
194
195
Set your access policy to grant *manage secrets* permissions to users:
195
196
196
197
```azurecli
@@ -229,7 +230,7 @@ The web app requires these components:
229
230
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FKeyVault-Rotation-SQLPassword-Csharp-WebApp%2Fmain%2FARM-Templates%2FWeb-App%2Fazuredeploy.json)
230
231
231
232
1. Select the **akvrotation** resource group.
232
-
1. In the **Sql Server Name**, type the Sql Server name with password to rotate
233
+
1. In the **SQL Server Name**, type the SQL Server name with password to rotate
233
234
1. In the **Key Vault Name**, type the key vault name
234
235
1. In the **Secret Name**, type secret name where the password is stored
235
236
1. In the **Repo Url**, type web app code GitHub location (**https://github.com/Azure-Samples/KeyVault-Rotation-SQLPassword-Csharp-WebApp.git**)
@@ -251,3 +252,4 @@ When the application opens in the browser, you will see the **Generated Secret V
251
252
- Overview: [Monitoring Key Vault with Azure Event Grid](../general/event-grid-overview.md)
252
253
- How to: [Receive email when a key vault secret changes](../general/event-grid-logicapps.md)
253
254
-[Azure Event Grid event schema for Azure Key Vault](../../event-grid/event-schema-key-vault.md)
0 commit comments