Secrets

Each website gets its own Key Vault. The Web App’s managed identity is granted Key Vault Secrets User. Optional vault_administrators receive admin role assignments.

Pulumi config → Key Vault

Store structured secrets in Pulumi config:

pulumi config set --secret --path 'mywebsite_social_auth_azure.key' '...'
pulumi config set --secret --path 'mywebsite_social_auth_azure.secret' '...'
pulumi config set --secret --path 'mywebsite_social_auth_azure.tenant_id' '...'
pulumi config set --secret --path 'mywebsite_social_auth_azure.client_id' '...'

Pass a mapping into add_django_website:

django.add_django_website(
    # ...
    secrets={
        "mywebsite_social_auth_azure": "AZURE_OAUTH",
    },
    environment_variables={},
)

• Key: Pulumi config object name
• Value: logical name used for the Key Vault secret and the App Setting prefix

The app receives AZURE_OAUTH_SECRET_NAME (the vault secret’s name). Secret names are normalized (underscores → hyphens, lowercased) in the vault.

Reading secrets in Django

With Azure settings imported, AZURE_KEY_VAULT_CLIENT is available when AZURE_KEY_VAULT is set:

import json
import environ
from pulumi_django_azure.settings import AZURE_KEY_VAULT_CLIENT

env = environ.Env()
oauth_secret = AZURE_KEY_VAULT_CLIENT.get_secret(env("AZURE_OAUTH_SECRET_NAME"))
oauth_secret = json.loads(oauth_secret.value)

SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = oauth_secret["client_id"]
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = oauth_secret["secret"]
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = oauth_secret["tenant_id"]

What is not in Key Vault

DJANGO_SECRET_KEY is a Pulumi RandomString injected directly as an App Setting, not stored in Key Vault.