Azure Key Vault Integration with Spring Boot
Fast recall
Quick revision
Core answer
Ability to eliminate plaintext secrets from application config using cloud-native secret management.
Hard-coding the Key Vault client secret or connection string instead of using Managed Identity for passwordless access.
Explain how Spring Cloud Azure maps Key Vault secret names to Spring property names, and mention secret rotation without restart.
Interview-ready guide
Interview answer
Azure Key Vault integration with Spring Boot works through a Spring PropertySource — secrets stored in Key Vault appear as regular Spring properties, which means your @Value("${db-password}") resolves from Key Vault at startup without any code changes.
Setup
- Add
spring-cloud-azure-starter-keyvault-secretsto dependencies; configurespring.cloud.azure.keyvault.secret.endpointwith the Key Vault URI; Spring Cloud Azure auto-configures theKeyVaultEnvironmentPostProcessorthat fetches all secrets at startup - Key Vault secrets are named with dashes —
db-password— and Spring Cloud Azure maps them to properties with dots:db.password; configure the property-source name prefix to avoid conflicts
Authentication — Managed Identity
- For applications running on Azure (App Service, AKS, Container Apps), use Managed Identity — the platform provides the Azure AD identity; Spring Cloud Azure's
DefaultAzureCredentialpicks it up automatically; no client secrets in config - For local development, use
az login—DefaultAzureCredentialfalls back to the Azure CLI credential when running outside Azure; the same code works locally and in production
Runtime secret refresh
- By default, Spring Cloud Azure loads secrets at startup and caches them for the process lifetime — which means a secret rotation in Key Vault doesn't take effect until the application restarts
- Configure
spring.cloud.azure.keyvault.secret.property-sources[0].refresh-intervalfor periodic re-fetch — appropriate for non-sensitive config; for security credentials, prefer a rolling restart strategy after rotation
Certificate management
- Key Vault also stores certificates and keys; use Key Vault-integrated TLS for App Service so Azure rotates and deploys certificates automatically — which means your app never has expired TLS certificates due to manual rotation failures
Azure Key Vault Integration with Spring Boot
Direct Answer
Add the spring-cloud-azure-starter-keyvault-secrets dependency, configure the Key Vault URI in application.properties, and grant the app a Managed Identity with Key Vault Secrets User role. Secrets are then accessible as Spring properties.
Common Mistakes & Pitfalls
Hard-coding the Key Vault client secret or connection string instead of using Managed Identity for passwordless access.
Check your understanding
Answer these without looking back at the article.
- What is DefaultAzureCredential and how does it resolve credentials in different environments?
- How do you handle Key Vault secret rotation without restarting your Spring Boot application?
- What is the difference between Key Vault access policies and RBAC-based access control?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.