Project: YugabyteDB (App Definition and Development / Database)
File: azure-key-vault.md

title: Developing Secure Applications with Azure Key Vault, Azure SDKs and YugabyteDB headerTitle: Secure applications using Azure Key Vault, Azure SDKs, and YugabyteDB linkTitle: Azure Key Vault description: Developing Secure Applications with Azure Key Vault, Azure SDKs and YugabyteDB image: /images/tutorials/azure/icons/Key-Vaults-Icon.svg headcontent: Use Azure SDKs to add services to applications menu: preview_tutorials: identifier: tutorials-azure-key-vault parent: tutorials-azure weight: 30 type: docs In this tutorial, we'll explore how you can leverage to interact with and use SDKs with database-backed applications, like those running YugabyteDB. The Azure SDKs are developed in a modular fashion. They provide developers with hooks into the services that their applications rely on, without bloating bundle sizes. The SDKs are developed for parity across many programming languages, but in this example we will use the for Node.js. In the following sections, you will: Create a node.js application that uses the Azure Key Vault SDK. Connect to the Azure Key Store from the application. Connect to the YugabyteDB database using the credentials stored in the key vault. A subscription, with An v18+ A account with a cluster deployed As the Azure Cloud continues to expand and evolve, so do the mechanisms used to deploy and interact with its services. Azure provides well over , and the list is growing. For instance, Azure's new can be used to . SDKs provide an interface to interact with Azure services via application code, but there are also available for download, including a rich command-line interface and a comprehensive set of Visual Studio Code extensions. Now, let's build a sample application which connects to the from Node.js. We'll then use the secrets stored in this service to connect to a YugabyteDB Managed cluster. A reference to the application we'll be developing can be found . Initialize a new directory for your project. ```sh mkdir YBAzureKeyStore && cd YBAzureKeyStore npm init -y ``` Install the . ```sh npm install @yugabytedb/pg ``` Install the Azure Key Vault secrets client library. ```sh npm install @azure/keyvault-secrets ``` Install the Azure Identity client library. ```sh npm install @azure/identity ``` Install and use it to set environment variables. ```sh npm install dotenv --save-dev ``` ```conf // .env KEYVAULTNAME="[NAMEOFKEYVAULTIN_AZURE]" DB_USERNAME="admin" DBPASSWORD="[YBMANAGEDDBPASSWORD]" //TIP: convert certificate to single line string for ease of use with DB client DBCERTIFICATE="[YBMANAGED_CERTIFICATE]" DBHOST="[YBDB_HOST]" ``` Connect to the Azure Key Store from Node.js. ```javascript // createSecrets.js const { SecretClient } = require("@azure/keyvault-secrets"); const { DefaultAzureCredential } = require("@azure/identity"); async function main() { // As stated by Microsoft, if you're using MSI, DefaultAzureCredential should "just

// Otherwise, DefaultAzureCredential expects the following three environment variables: // - AZURETENANTID: The tenant ID in Azure Active Directory // - AZURECLIENTID: The application (client) ID registered in the Azure AD tenant // - AZURECLIENTSECRET: The client secret for the registered application const credential = new DefaultAzureCredential(); const keyVaultName = process.env["KEYVAULTNAME"]; if (!keyVaultName) throw new Error("KEYVAULTNAME is empty"); const url = "https://" + keyVaultName + ".vault.azure.net"; const client = new SecretClient(url, credential); ``` Use the secret client to set the secrets needed to establish a YugabyteDB Managed connection. ```javascript // createSecrets.js async function main(){ ... // Create secrets for YugabyteDB Managed connection await client.setSecret("DBUSERNAME", process.env.DB_USERNAME); await client.setSecret("DBPASSWORD", process.env.DB_PASSWORD); await client.setSecret("DBCERTIFICATE", process.env.DB_CERTIFICATE); await client.setSecret("DBHOST", process.env.DB_HOST); // Get secrets to confirm they've been set in Azure Key Vault for await (let secretProperties of client.listPropertiesOfSecrets()) { console.log("Secret Name: ", secretProperties.name); const secret = await client.getSecret(secretProperties.name); console.log("Secret Val:", secret.value); } } main().catch((error) => { console.error("An error occurred:", error); process.exit(1); }); ``` ```sh node createSecrets.js ``` Read these secrets from Azure and connect to YugabyteDB Managed. ```javascript // index.js const { Client } = require("@yugabytedb/pg"); const { SecretClient } = require("@azure/keyvault-secrets"); const { DefaultAzureCredential } = require("@azure/identity"); async function main() { const credential = new DefaultAzureCredential(); const keyVaultName = process.env["KEYVAULTNAME"]; if (!keyVaultName) throw new Error("KEYVAULTNAME is empty"); const url = "https://" + keyVaultName + ".vault.azure.net"; const secretClient = new SecretClient(url, credential); const dbhost = await secretClient.getSecret("DBHOST"); const dbusername = await secretClient.getSecret("DBUSERNAME"); const dbpassword = await secretClient.getSecret("DBPASSWORD"); const dbcertificate = await secretClient.getSecret("DBCERTIFICATE"); const ybclient = new Client({ database: "yugabyte", host: dbhost.value, user: dbusername.value, port: 5433, password: dbpassword.value, max: 10, idleTimeoutMillis: 0, ssl: { rejectUnauthorized: true, ca: dbcertificate.value, servername: dbhost.value, }, }); console.log("Establishing connection with YugabyteDB Managed"); await ybclient.connect(); console.log("Connected successfully."); } main().catch((error) => { console.error("An error occurred:", error); process.exit(1); }); ``` ```sh node index.js ``` ```output Establishing connection with YugabyteDB Managed... Connected successfully. ``` Thanks to the Azure Key Vault SDK, we've successfully connected to YugabyteDB, using credentials stored securely in the cloud. This protects our data and ensures a simplified development environment, where credentials can be centrally updated by multiple end users. The Azure Key Vault SDK comes with additional features for interacting with secrets. These include the ability to update, delete, and purge values if required. You can also use the Azure web console to make any necessary changes. We've just scratched the surface with what is possible using Azure SDKs and the surrounding ecosystem. We'll be developing more applications on Azure in the coming months as the list of tools continues to expand. If you're also interested in building applications using Azure App Service, refer to . You can also use Azure Key Vault to store customer managed keys for encrypting clusters in YugabyteDB Managed - see .