title: How does Azure Key Vault provide better security than encrypted configuration settings?
body: <p>I have an ASP.NET Core website that is used to store and retrieve encryption keys which are, at times, used to &quot;sign transactions&quot; on behalf of the user.</p>
  <p>Since I'm in Azure, research indicates the most secure way to store these keys is via <a href="https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts" rel="nofollow noreferrer">Azure Key Vault</a>.</p>
  <p>I've looked at <a href="https://medium.com/dotnet-hub/use-azure-key-vault-with-net-or-asp-net-core-applications-read-azure-key-vault-secret-in-dotnet-fca293e9fbb3" rel="nofollow noreferrer">this article</a>, which shows that to gain access Azure Key Vault values, I would end up using credentials stored in the <a href="https://docs.microsoft.com/en-us/azure/app-service/configure-common" rel="nofollow noreferrer">Web App's Application Configuration settings</a>.</p>
  <pre><code>// Connect to Azure Key Vault using the Client Id and Client Secret (AAD) - Get them from Azure AD Application.
  
  var keyVaultEndpoint = settings[&quot;AzureKeyVault:Endpoint&quot;];
  var keyVaultClientId = settings[&quot;AzureKeyVault:ClientId&quot;];
  var keyVaultClientSecret = settings[&quot;AzureKeyVault:ClientSecret&quot;];
  
  if (!string.IsNullOrEmpty(keyVaultEndpoint) &amp;&amp; !string.IsNullOrEmpty(keyVaultClientId) &amp;&amp; !string.IsNullOrEmpty(keyVaultClientSecret))
  {
       config.AddAzureKeyVault(keyVaultEndpoint, keyVaultClientId, keyVaultClientSecret, new DefaultKeyVaultSecretManager());
  }
  </code></pre>
  <p>Web App Application Configuration settings are encrypted at rest and during transit, but their values can be leaked in a number of ways, hence the need for Key Vault.</p>
  <p>My question, however, is if I have to store the Key Vault access credentials somewhere in the app configuration, doesn't that essentially limit the security of key vault values to the same level as what the configuration setting already provides?  Does the extra level of indirection make a difference somehow?</p>
  <p>What's the point of using Key Vault if someone can just access the Key Vault by reading the Key Vault credentials from the Web Config Settings?</p>
  <p>What am I missing?</p>