Tutorial: Use Azure Key Vault with a virtual machine in JavaScript

Azure Key Vault helps you to protect keys, secrets, and certificates, such as API keys and database connection strings.

In this tutorial, you set up a Node.js application to read information from Azure Key Vault by using managed identities for Azure resources. You learn how to:

Before you begin, read Key Vault basic concepts.

If you don't have an Azure subscription, create a trial subscription.

For Windows, Mac, and Linux:

• Git
• This tutorial requires that you run the Azure CLI locally. You must have the Azure CLI version 2.0.4 or later installed. Run az --version to find the version. If you need to install or upgrade the CLI, see Install Azure CLI 2.0.

To log in to Azure by using the Azure CLI, enter:

az cloud set -n AzureChinaCloud
az login
# az cloud set -n AzureCloud   //means return to Public Azure.

This quickstart uses a precreated Azure key vault. You can create a key vault by following the steps in the Azure CLI quickstart, Azure PowerShell quickstart, or Azure portal quickstart.

Alternatively, you can run these Azure CLI or Azure PowerShell commands.

az group create --name "myResourceGroup" -l "ChinaEast"

az keyvault create --name "<your-unique-keyvault-name>" -g "myResourceGroup" --enable-rbac-authorization

New-AzResourceGroup -Name myResourceGroup -Location chinaeast

New-AzKeyVault -Name <your-unique-keyvault-name> -ResourceGroupName myResourceGroup -Location chinaeast

Let's create a secret called mySecret, with a value of Success!. A secret might be a password, a SQL connection string, or any other information that you need to keep both secure and available to your application.

To add a secret to your newly created key vault, use the following command:

az keyvault secret set --vault-name "<your-unique-keyvault-name>" --name "mySecret" --value "Success!"

$secret = ConvertTo-SecureString -String 'Success!' -AsPlainText
Set-AzKeyVaultSecret -VaultName <your-unique-keyvault-name> -Name mySecret -SecretValue $secret

Create a VM called myVM using one of the following methods:

To create a Linux VM using the Azure CLI, use the az vm create command. The following example adds a user account named azureuser. The --generate-ssh-keys parameter is used to automatically generate an SSH key, and put it in the default key location (~/.ssh).

az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys

Note the value of publicIpAddress in the output.

Create a system-assigned identity for the virtual machine by using the Azure CLI az vm identity assign command:

az vm identity assign --name "myVM" --resource-group "myResourceGroup"

Note the system-assigned identity that's displayed in the following code. The output of the preceding command would be:

{
  "systemAssignedIdentity": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "userAssignedIdentities": {}
}

Now you can assign the previously created identity permissions to your key vault by running the following command:

az keyvault set-policy --name "<your-unique-keyvault-name>" --object-id "<systemAssignedIdentity>" --secret-permissions get list

To sign in to the virtual machine, follow the instructions in Connect and sign in to an Azure virtual machine running Linux or Connect and sign in to an Azure virtual machine running Windows.

To log into a Linux VM, you can use the ssh command with the <publicIpAddress> given in the Create a virtual machine step:

ssh azureuser@<PublicIpAddress>

On the virtual machine, install the two npm libraries we'll be using in our JavaScript script: @azure/keyvault-secrets and @azure/identity.

1. In the SSH terminal, install Node.js and npm with the following commands:

   curl -sL https://deb.nodesource.com/setup_14.x | sudo -E bash - && \
       sudo apt-get install -y nodejs
   

2. Create an app directory and initialize the Node.js package:

   mkdir app && cd app && npm init -y
   

3. Install the Azure service packages using npm:

   npm install @azure/keyvault-secrets @azure/identity
   

1. On the virtual machine in the app directory, create a JavaScript file called index.js.

   touch index.js
   

2. Open the file with the Nano text editor:

   nano index.js
   

3. Copy the following code, replacing <your-unique-keyvault-name> with the name of your key vault, and paste into the Nano editor:

   // index.js
   
   const { SecretClient } = require("@azure/keyvault-secrets");
   const { DefaultAzureCredential } = require("@azure/identity");
   
   // Your Azure Key Vault name and secret name
   const keyVaultName = "<your-unique-keyvault-name>";
   const keyVaultUri = `https://${keyVaultName}.vault.azure.cn`;
   const secretName = "mySecret";
   
   // Authenticate to Azure
   const credential = new DefaultAzureCredential();
   const client = new SecretClient(keyVaultUri, credential);
   
   // Get Secret with Azure SDK for JS
   const getSecret = async (secretName) => {
   
       return (await client.getSecret(secretName)).value;
   }
   
   getSecret(secretName).then(secretValue => {
       console.log(`The value of secret '${secretName}' in '${keyVaultName}' is: '${secretValue}'`);
   }).catch(err => {
       console.log(err);
   })
   

4. Save the file with Ctrl + x.

5. When asked Save modified buffer?, enter y.

6. When asked File Name to Write: index.js, enter Enter.

Lastly, run index.js. If all has gone well, it should return the value of your secret:

node index.js

The value of secret 'mySecret' in '<your-unique-keyvault-name>' is: 'Success!'

When they are no longer needed, delete the virtual machine and your key vault. You can do this quickly by simply deleting the resource group to which they belong:

az group delete -g myResourceGroup

Azure Key Vault REST API