Where to store secret token retrieved during runtime?

Question

Hi Team,

I'm trying to visualize and best way to implement a very common enterprise use case.

I'm using ADF, Key Vault, Azure SQL data base as inventories.

Requirement is to fetch some data from an exposed API. Before calling the API I need to generate one access token by calling a different API from the same vendor. This token has TTL 3 months. So I prefer to store it in my inventories.

Now I'm confused where to store the runtime secret?

In KV if we try to store, I need to give ADF Service Principle, set access to KV which may not be a good solution. Even after saving I need to store the secret version for retrieving the value again.

Within ADF I can't store as after ADF execution completes this secret will be destroyed.

Can we store it in Azure SQL by allowing masing? Can SQL protect the secure token properly?

Please share your views.

Regards,

Partha

Answer 1

@Pratim Das, Partha C

Answering to your query: If I set key vault secret value in runtime, the version will change. How can I know going forward which version to use?

As per :https://learn.microsoft.com/en-us/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities

The secret-version is optional; the latest version is returned when not specified. It is often desirable to specify a secret URI in a pipeline without a specific version so that the pipeline always uses the latest version of the secret.

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik