如何在PAAS应用中利用Azure Key Vault缓存数据减少密钥调用？

Great question! When building PaaS applications with Azure Key Vault, caching secrets is a no-brainer to cut down on latency, reduce costly Key Vault API calls, and make your app more responsive. Let's break down the best ways to do this—both using built-in SDK features and custom solutions—plus key things to keep in mind.

Most official Azure SDKs for Key Vault include out-of-the-box caching, so you don’t have to build everything from scratch. This is the simplest starting point, especially if you’re using standard Azure libraries.

For example, in the .NET Azure.Security.KeyVault.Secrets SDK, the SecretClient automatically caches secrets by default. You can tweak the cache behavior using SecretClientOptions to control expiration times:

var options = new SecretClientOptions()
{
    Cache = new SecretCacheOptions()
    {
        // Set how long secrets stay cached (adjust based on your secret rotation frequency)
        Expiration = TimeSpan.FromHours(1)
    }
};

// Initialize client with caching enabled
var client = new SecretClient(
    new Uri("https://your-vault-name.vault.azure.net/"), 
    new DefaultAzureCredential(), 
    options);

This cache is tied to your SecretClient instance—so if you use a singleton client (which you should, for efficiency), the cache will be shared across your entire app.

If you need more control (like cross-instance cache consistency or integration with existing caching infrastructure), custom solutions are the way to go.

In-Memory Caching #

Best for single-instance PaaS apps (e.g., a single App Service instance). Use your language’s built-in memory cache to store secrets temporarily:

private readonly IMemoryCache _cache;
private readonly SecretClient _keyVaultClient;
private const string CacheKeyPrefix = "KeyVaultSecret_";

public SecretService(IMemoryCache cache, SecretClient keyVaultClient)
{
    _cache = cache;
    _keyVaultClient = keyVaultClient;
}

public async Task<string> GetSecretAsync(string secretName)
{
    var cacheKey = $"{CacheKeyPrefix}{secretName}";
    
    // Check cache first to avoid Key Vault call
    if (_cache.TryGetValue(cacheKey, out string cachedSecret))
    {
        return cachedSecret;
    }
    
    // Fetch from Key Vault if not in cache
    var secretResponse = await _keyVaultClient.GetSecretAsync(secretName);
    var secretValue = secretResponse.Value.Value;
    
    // Store in cache with expiration (e.g., 2 hours)
    _cache.Set(cacheKey, secretValue, TimeSpan.FromHours(2));
    
    return secretValue;
}

Distributed Caching with Azure Redis Cache #

Ideal for multi-instance PaaS apps (e.g., scaled-out App Service, AKS pods). Azure Redis Cache provides a centralized, shared cache that all your app instances can access, ensuring consistent secret values across your deployment:

1. Deploy an Azure Redis Cache instance and retrieve its connection string.
2. Configure your app to use IDistributedCache (in .NET, this is done via AddStackExchangeRedisCache in your startup configuration).
3. Implement the caching logic:

private readonly IDistributedCache _distributedCache;
private readonly SecretClient _keyVaultClient;
private const string CacheKeyPrefix = "KeyVaultSecret_";

public SecretService(IDistributedCache distributedCache, SecretClient keyVaultClient)
{
    _distributedCache = distributedCache;
    _keyVaultClient = keyVaultClient;
}

public async Task<string> GetSecretAsync(string secretName)
{
    var cacheKey = $"{CacheKeyPrefix}{secretName}";
    
    // Check distributed cache first
    var cachedSecret = await _distributedCache.GetStringAsync(cacheKey);
    if (!string.IsNullOrEmpty(cachedSecret))
    {
        return cachedSecret;
    }
    
    // Fetch fresh secret from Key Vault
    var secretResponse = await _keyVaultClient.GetSecretAsync(secretName);
    var secretValue = secretResponse.Value.Value;
    
    // Store in Redis with expiration
    await _distributedCache.SetStringAsync(
        cacheKey, 
        secretValue, 
        new DistributedCacheEntryOptions { AbsoluteExpirationRelativeToNow = TimeSpan.FromHours(1) });
    
    return secretValue;
}

• Set a Balanced Cache Expiration: Don’t set it too long (risk serving stale secrets) or too short (defeats the purpose of caching). For infrequently rotated secrets, 1-24 hours works; for often-updated secrets, use 15-30 minutes.
• Handle Secret Rotation: If you rotate secrets in Key Vault, you need to invalidate the cache to avoid stale values. Use Azure Event Grid to subscribe to secret update events—when an event triggers, have your app delete the corresponding cache entry.
• Secure Cached Secrets: For in-memory cache, ensure your app process runs with minimal permissions. For Redis, enable SSL, use encryption at rest, and restrict access via Azure RBAC or Redis access keys.
• Respect Rate Limits: Azure Key Vault has throttling limits (e.g., 2,000 requests per minute for the standard tier). Caching directly reduces your call volume, helping you stay under these limits.

内容的提问来源于stack exchange，提问作者namrata