Our platform team is designing secrets management for several applications in the same delivery group. We could manage one Key Vault per environment, or create separate vaults for each application or team. A shared vault would be easier for the platform team and simpler for development teams, but we must ensure that applications and teams cannot access one another's secrets. Ideally, teams could add and manage secrets in their own isolated area without having to ask the platform team every time. Is that isolation practical in a shared vault, or is a separate vault per application or team the better design? Also, what is the recommended way for applications to authenticate to Azure Key Vault without storing another secret for authentication?
1 Answer
Let teams create and update their own secrets through infrastructure as code, such as Bicep or Terraform, rather than giving broad portal permissions or making every change a platform-team ticket. The platform team can provide a reusable module that creates the vault, diagnostic settings, RBAC assignments, private networking, and retention protections. This keeps the process self-service while preserving consistent security controls.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures