Receive credentials from keyvault within an IoT Hub edge module

Hello Tobias Quadfasel,

Thank you for posting your question in the Microsoft Q&A forum. 

To securely access Azure Key Vault from your IoT Edge module, you’ll need to implement one of the following approaches since the IoT Hub’s managed identity isn’t directly available to modules. The recommended method is to leverage the device’s own identity by enabling a managed identity for the IoT Edge device itself (if using Azure IoT Hub with Azure Arc-enabled devices) and granting it Key Vault Secret User access. Alternatively, you can use module-specific authentication by either: 

• Deploying a service principal (stored as an environment variable or in a secure module twin property) for Key Vault access. 
• Implementing certificate-based authentication (X.509) for the module, tied to Azure AD. 
• Using IoT Edge’s Key Store for secrets, synced from Key Vault via the IoT Edge runtime. 

For minimal code changes, DefaultAzureCredential can still work if you configure environment variables (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET) in the module deployment manifest. However, for production, prefer device-level managed identities or certificate-based auth to avoid hardcoded credentials. 

If your IoT Edge device runs on an Azure VM, you could also attach the VM’s managed identity to the module. Always ensure Key Vault firewall rules allow access from the module’s IP or trusted services. 

Reference

https://dori-uw-1.kuma-moon.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

https://dori-uw-1.kuma-moon.com/en-us/entra/identity/managed-identities-azure-resources/overview

https://github.com/Azure/iotedge/issues/1300

If the above answer helped, please do not forget to "Accept Answer" as this may help other community members to refer the info if facing a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated. 

Hello @Tobias Quadfasel ,

welcome to this moderated Azure community forum.

You want to distribute secrets to an Azure IoT Edge custom module.

These secrets are stored in an Azure keyvault.

The usual way to provide parameters to a module is making use of desired properties, part of the module twin.

The desired properties is a JSON structure and once updated in the cloud for a certain module in a certain device, it is picked up by the module (and a copy is stored in the EdgeHub for offline purposes) when a change is detected.

The device module can return a reported property in exchange to indicate the parameters is received.

Having these parameters distributed this way makes the data transmission lean and it supports offline scenarios. You also only need access to the IoT hub, other Azure resources (like a keyvault) do not need a public endpoint.

You want want to distribute secrets.

By default, the module twin is accessible by admins in the azure admin portal.

But you could also implement a custom flow and let the module ask for secrets by sending out a 'marked' message (eg having a specific application property (other than a system property)) so the IoT Hub routing could route the message to some logic (like an Azure Function).

Using the desired properties for distributing secrets with limited usages is a good idea because then offline support is still implemented.

I have used this to provide access to Azure Storage containers by creating a SAS token (which have a limited use in access and time). See this blog post with the example.

I'm not sure if Azure Keyvault supports SAS tokens (see this documentation) but a simular approach could work with any secret database...

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.