pythonazureazure-data-factoryazure-keyvaultazure-batch

How to read secrets from Key Vault without using Service Principle in Python Scripts

We are running Python scripts in Azure Data Factory using Batch Service of Azure Data Factory. We are reading secrets from key vault using Service Principle for which we need to hardcode the Client Id, Client Secret which has the access to read secret values. Is there any way to overcome this problem so that there is no requirement of hardcoding the Service Principle. Can we use Managed Identities in this case?

We tried using Managed Identities and we created a User Managed identity to access the key vault. The Batch Account and Azure Data Factory has been provided the access to this User Managed Identity. But we are unable to find the next steps in the same case.

We have User-Assigned managed identity which has been associated to both Data Factory and Batch Account and this Managed Identity has Secret read permissions as well. enter image description here

Running the below python script to read the Secrets.

enter image description here

But the issue now we are facing is defined below: enter image description here

The managed identity has the following associated resources : enter image description here

Solution

  • When we are developing Azure Batch Account and deploying pools in the Batch Account the created Managed Identity should have Secrets Read permissions.

    The Managed Identity should be associated to the below mentioned resources in this case .

    1. Azure Data Factory
    2. Azure Batch Account 3. Pool developed under Batch Account

    We were not associating Managed Identity to the pool created and was facing this error. The below Python Script worked for me. enter image description here

    Thanks