Azure Keyvault to access resources from different azure subscriptions

3
votes

I am trying to use azure keyvault in my MVC application to get storage account keys. This MVC application is hosted in different azure subscriptions with storage accounts belonging to those subscriptions. Is it possible to have a one Azure Keyvault resource in any subscription and serve keys for storage accounts residing in different subscriptions?

2
azureazure-storageazure-keyvault
Are those subscriptions linked to the same Azure AD tenant? – juunas
Not at the moment. Few of those subscriptions share common AD Tenant. But few other share different AD tenent. – Venky

2 Answers

3
votes

Yes it is possible.

You will need to make identities for the apps using the Key Vault in the Azure AD tenant where the Key Vault's subscription is. And then assign permissions to access the vault to those service principals.

Then you can put the client id, client secret and tenant id to the apps that need to access the Key Vault. They should then be able to call it, since they have an identity that is allowed access. Key Vault uses an HTTP API so whether the apps and the vault are in the same subscription/data center/cloud provider is irrelevant.

0
votes

Hi you can use below to do via azure CLI

 az webapp config ssl import -n 'webappname' -g 'webappresourcegroup' --key-vault "/subscriptions/[provide subscriptionID]/resourceGroups/[Provide resource group Name]/providers/Microsoft.KeyVault/vaults/[Provide Vault Name] --key-vault-certificate 'Provide certificate Name'