Connection string support to load from Credential Vault + password rotation

[Lewis-Teoh]

Does this library n .NET Core to support loading connection strings from a secure Credential Vault (e.g., Azure Key Vault, AWS Secrets Manager, HashiCorp Vault), with built-in support for password rotation?

[leonibr]

This library does not have built-in support for loading connection strings directly from secure credential vaults, nor does it have built-in support for automatic password rotation.

However, you can use .NET’s configuration system to achieve secure secret management, you can use .NET Core’s configuration providers to load connection strings or secrets from services like Azure Key Vault or AWS Secrets Manager at application startup. The library will then use the connection string provided by your app’s configuration.

If your configuration provider supports dynamic secret refresh, you would need to ensure that the application and this library can re-read the updated connection string at runtime. Currently, the connection string is typically read once at startup.

Azure App Configuration can emit events to Event Grid when a key (or Key Vault reference) is updated.
You can subscribe to these events and trigger your app (or a function) to refresh its configuration.

[Lewis-Teoh]

Thanks for the clarification. Is this something that might be considered as a future feature or enhancement?

[leonibr]

Well, I am still testing it but would be nice if you help me validating it, see it here Azure-key-vault-rotation-support, version 5.1.0-next