Skip to content

Key Vault Reference

This recipe shows how to securely store and retrieve Azure Communication Services (ACS) connection strings from Azure Key Vault using JavaScript.

This recipe walks these steps in order:

flowchart TD
    START["Key Vault Reference"]
    N1["Prerequisites"]
    N2["SDK Installation"]
    N3["Store Connection String in Key Vault"]
    N4["Access from Node.js App"]
    N5["Rotation Strategy"]
    START --> N1
    N1 --> N2
    N2 --> N3
    N3 --> N4
    N4 --> N5

Prerequisites

SDK Installation

npm install @azure/identity @azure/keyvault-secrets

Store Connection String in Key Vault

# Store the connection string as a secret
az keyvault secret set --vault-name <your-vault-name> --name "AcsConnectionString" --value "<your-acs-connection-string>"
Command Purpose
az keyvault secret set Stores or updates a secret in Azure Key Vault.
--vault-name <your-vault-name> Names the Key Vault that holds the secret.
--name "AcsConnectionString" Names the secret to store.
--value "<your-acs-connection-string>" Sets the secret value (the ACS connection string).

Access from Node.js App

const { DefaultAzureCredential } = require("@azure/identity");
const { SecretClient } = require("@azure/keyvault-secrets");
const { CommunicationIdentityClient } = require("@azure/communication-identity");

// Key Vault name and secret name
const vaultName = process.env.KEY_VAULT_NAME;
const secretName = "AcsConnectionString";

// Vault URL
const vaultUrl = `https://${vaultName}.vault.azure.net`;

async function main() {
  // Initialize SecretClient with DefaultAzureCredential
  const credential = new DefaultAzureCredential();
  const secretClient = new SecretClient(vaultUrl, credential);

  // Retrieve secret
  const retrievedSecret = await secretClient.getSecret(secretName);
  const connectionString = retrievedSecret.value;

  // Initialize ACS client with retrieved connection string
  const acsClient = new CommunicationIdentityClient(connectionString);

  // Perform ACS operations
  const user = await acsClient.createUser();
  console.log(`Created user using connection string from Key Vault: ${user.communicationUserId}`);
}

main();

Rotation Strategy

Regularly rotating your secrets is a security best practice. ACS connection strings can be rotated manually or automated using Azure Functions and Event Grid.

  1. Generate a new key for your ACS resource.
  2. Update the secret in Key Vault with the new connection string.
  3. Your application will automatically retrieve the updated secret upon the next restart or if you implement a periodic refresh mechanism.

Important

Key Vault supports versioning, allowing you to easily roll back if a new key fails.

See Also

Sources