The Digital Safe

Azure Key Vault is a centralized cloud service for storing and managing sensitive information.

1. Secrets, Keys, and Certs

- **Secrets:** Passwords, Connection Strings, API Keys (plain text).
- **Keys:** Cryptographic keys used for encryption/decryption (never leave the HSM).
- **Certificates:** Managed SSL/TLS certificates with auto-renewal.

2. RBAC vs Access Policies

Modern Key Vaults use **Azure RBAC** (Role-Based Access Control). This is the 'Senior Architect' way. Instead of messy 'Access Policies', you assign the 'Key Vault Secrets User' role directly to your .NET app's **Managed Identity**. This is cleaner, more secure, and easier to audit.

3. Architect Insight

Q: "How do I inject Key Vault into my .NET configuration?"

Architect Answer: "Use the Azure.Extensions.AspNetCore.Configuration.Secrets package. In your Program.cs, call config.AddAzureKeyVault(...). All your secrets will then appear in your IConfiguration object just like local settings, but without the security risk of storing them on disk."