Best practices for storage and reuse of secrets between multiple Azure webjobs associated with the same website

0
votes

I'm trying to follow the suggestions shown in Best practices for deploying passwords and other sensitive data to ASP.NET and Azure App Service. The primary tenet of the document is that when on Azure, secrets shouldn't be stored in application configuration files; they should be stored in the Application Settings blade of the App Service.

I've got multiple webjobs associated with a given Azure App Service (website). The webjobs all talk to the same external api but they each have their own individual secrets associated with it, e.g. api tokens. To simplify configuration, each of the webjobs' app.config files in the development environment have the same app setting key, e.g.

<add key="AWSApiToken" value="token_for_webjob1" /> <!--webjob1-->
<add key="AWSApiToken" value="token_for_webjob2" /> <!--webjob2-->
<add key="AWSApiToken" value="token_for_webjob3" /> <!--webjob3-->

The problem here is that while the webjobs each have individual app.config files in development, they share the Applications Settings blade associated with their common website in Azure.

So if the best practice is to store app secrets in Azure, what would I do for the case of multiple webjobs associated with the same site if I wanted to keep using common key names for the app settings?

1
azureazure-web-app-serviceazure-webjobs

1 Answers

1
votes

If the WebJobs are all hosted within the same Azure Web App, then you could just use a single App Setting named "ApiToken" that you set on the Azure Web App within Application Settings. Then each of the Web Jobs can just use that same App Setting to get the Api Token to use.

If you do require the same App Settings name for each of the Web Jobs but require a different value for each Web Job, then you'll need to either 1) modify the Web Jobs to use distinct App Settings keys, or 2) host the Web Jobs each in a separate Web App. If you host each Web Job in a dedicated Web App, then you can host all three Web Apps for your Web Jobs within the same App Service Plan. This will allow you to have completely separate App Settings per Web Job, AND save cost by using the same App Service Plan and it's resources to host all 3 Web Jobs.

Azure KeyVault would be the service you are looking to use if you need to be able to share keys with multiple apps securely that are all hosted separately.