将EH连接字符串、ClientID和密钥存入Key Vault是否为通用做法？

Absolutely—storing Event Hub (EH) connection strings, client IDs, and secrets in Azure Key Vault is a universal best practice across all types of Azure workloads, not just web applications. Here’s why and how to approach it for producer clients:

Why This is a Standard Practice #

• Eliminates hardcoding risks: Hardcoding credentials in code, config files, or source control is a massive security red flag—exposing sensitive data to anyone with access to your repo or deployment artifacts.
• Centralized secure management: Key Vault lets you rotate credentials, set access policies, and audit usage all in one place, instead of updating them across every producer instance.
• Compliance alignment: Most industry compliance standards (like GDPR, HIPAA) require secure storage of sensitive credentials, which Key Vault is built to satisfy.
• Fine-grained access control: You can restrict which producer identities (like managed identities or service principals) can retrieve specific secrets, minimizing the blast radius if a credential is compromised.

Yes, Producers Should Retrieve Credentials From Key Vault #

Whether your producer is a console app, background service, IoT device, serverless function, or web app, configuring it to pull credentials from Key Vault is the correct approach. Microsoft docs might lean heavily on web app examples, but this pattern applies universally.

Example for a .NET Event Hub Producer #

Here’s a quick snippet showing how to retrieve an Event Hub connection string from Key Vault and use it to create a producer client:

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Azure.Messaging.EventHubs.Producer;

// Initialize Key Vault client
var secretClient = new SecretClient(
    new Uri("https://your-keyvault-name.vault.azure.net/"),
    new DefaultAzureCredential());

// Retrieve the Event Hub connection string secret
var secret = await secretClient.GetSecretAsync("eventhub-connection-string");
string ehConnectionString = secret.Value.Value;

// Create the Event Hub producer client
await using var producerClient = new EventHubProducerClient(ehConnectionString, "your-eventhub-name");

// Use the producer to send events...

Key Notes for Non-Web Producers #

• Use Managed Identities: For cloud-hosted producers (like VMs, AKS pods, or Azure Functions), assign a managed identity to the resource and grant it Secrets User access in Key Vault. This removes the need to store any credentials for the producer itself.
• Local Development: The DefaultAzureCredential automatically uses your local Azure CLI/Visual Studio credentials to access Key Vault during development, so you don’t need to hardcode dev secrets either.
• Other Languages: Similar libraries exist for Python, Java, JavaScript, etc.—look for Azure Identity and Key Vault SDKs specific to your stack.

Final Takeaway #

Don’t let the web-app-focused docs fool you—this pattern is standard for all Event Hub producers. It’s secure, scalable, and aligns with Azure’s core security best practices.

内容的提问来源于stack exchange，提问作者Dazure