azure-keyvault-appconfig

Standard IDs

ID	Severity	What it checks
KVA-001	P0	Secret value defined inline (Bicep param/App Setting) instead of a Key Vault reference
KVA-002	P0	App Configuration / Key Vault accessed by connection string or access key, not managed identity
KVA-003	P1	Key Vault missing enableSoftDelete + enablePurgeProtection
KVA-004	P1	Feature flags stored in App Settings/env instead of the App Configuration flag store
KVA-005	P1	Key Vault / App Configuration publicNetworkAccess enabled with no private endpoint

dotnet-secrets-rotation, dotnet-dynamic-configuration, and dotnet-feature-flags govern how the application reads secrets, refreshes config, and evaluates flags — all of which assume a backing store exists and is reachable by identity. This skill governs the Azure resources that provide it: Key Vault and App Configuration, provisioned in Bicep, accessed by managed identity (never a key), so the consumer-side skills have something safe to consume. Complements azure-security-baseline ASB-IM-2 (Key Vault for secrets) with the concrete Bicep wiring.

---

Check A — No inline secrets; use Key Vault references (KVA-001)

Detection

Scan Bicep and app-settings for secret-looking values assigned literally — a connection string with a password, an API key, a client secret — where the value should be a Key Vault reference resolved at runtime by identity. A secret in a Bicep param or an App Service appSettings entry lands in deployment history and the portal in cleartext.

BAD — client secret handed to the app as a literal setting

resource site 'Microsoft.Web/sites@2023-12-01' = {
  properties: {
    siteConfig: {
      appSettings: [
        { name: 'Db__Password', value: dbPassword }   // KVA-001: literal secret in config
      ]
    }
  }
}

GOOD — App Setting is a Key Vault reference, resolved by the site's managed identity

appSettings: [
  {
    name: 'Db__Password'
    value: '@Microsoft.KeyVault(SecretUri=${kv.properties.vaultUri}secrets/db-password/)'
  }
]
// The app's system-assigned identity has 'Key Vault Secrets User' on the vault (Check B).