Secure Key Vault access without Workspace Identity

[Eddykleinjan]

Hi,

I'm ready to dive into the first real Fabric project getting data from a specific app's API. This requires using secrets to access the soure data app's API. I don't want to store these secrets in source code (insecure coding) and want to use Azure Key Vault instead. To access the Azure Key vault, the notebook process needs to have access to Azure Key Vault.

Now Fabric has an option to assign a identity to a workspace (workspace identity) and authorize that workspace identity to access the key vault. This souds like a solution, but the catch here is that the workspace identity is only available starting with the Fabric F64 capacity. Since pricing for F64 starts at USD 10k+ per month, that is not an option for us or our customers.

Also note that I would like to run this code (notebook) unattended, so an interactive authentication of the user running the notebook is not an option.

Anyone ran into this? Would love to hear what approach you took.

[frithjof_v · Accepted solution]

Perhaps you can use this:

https://learn.microsoft.com/en-us/fabric/data-engineering/notebook-utilities#credentials-utilities

[Eddykleinjan]

Thanks for the pointer, that works! It reads the value from the Key Vault both when run interactively and when running the notebook scheduled.

When running the notebook scheduled, it seems to run under the account that has created the schedule for the notebook. That way the scheduled notebook run could read the secret from the Azure Key Vault.

test_secret = notebookutils.credentials.getSecret('https://<url_to_key_vault>/', '<secret_name>')
# Reverse the value in order to show it. Otherwise it will be shown as '[REDACTED]'
reversed_string = test_secret[::-1]
print (f"Secret value reversed: {reversed_string}")

[Eddykleinjan]

That's good news! Should then work ask hoped for/expected. I'll give it a try.

[Jaimini]

Hi @Eddykleinjan 

1. The F64+ requirement is no longer valid. You can now create up to 1,000 workspace identities.

2. Important: Currently, authentication with workspace identities, specifically for Key Vault, is not available.

3. Interestingly, if you have access to Key Vault with your domain account and run the notebook using the same account, you will be able to access the Key Vault secrets. You can use mssparkutils for this.

4. Additionally, you can create a Spark job definition using the same code (as mentioned in point 3). If you schedule and run it, it will work, using your account for authentication.

For now, managed/workspace identity authentication for Key Vault is not functioning.

@v-jingzhan-msft 

[v-jingzhan-msft]

Hi @Eddykleinjan 

I haven't tested whether the workspace identity can access the Azure Key Vault. Could you please share your results with us later? Thank you in advance.

Best Regards,
Jing

[Eddykleinjan]

Hi Jing,
Will do! For now creating a workspace identity gives an error (status: Failed). Will start a support incident on this error occurs both under a Fabric Trial capacity and a real Fabric F2 capacity.
Best regard, Eddy

[Eddykleinjan]

Hi Jing,

Creating the workspace identity didn't work because the workspace name had special characters in the name, a space in my case. Microsoft had identified this as a problem and will fix this.

@Jaimini reported that accessing the Key Vault is not possible using the workspace identity, I chose to use the notebookutils way that @frithjof_v adviced. That worked; see my reply to his message.

[v-jingzhan-msft]

Thank you very much! I really appreciate the results you share!

[codenamesql]

Hey @Eddykleinjan, The F64 + requirement is no longer valid for Workspace Identity.  You can now create a workspace identity with any F sku.  This should allow you to accomplish what you are looking for.