How to authenticate Azure Storage Account using Key Vault in Azure Data Factory

 How to authenticate Azure Storage Account using Key Vault in Azure Data Factory

Open the portal blade for your storage account 🡪 Select Access keys

To copy key values, you must first click Show keys 🡪 Copy the Connection string value for key1

Open key vault 🡪 Secrets 🡪 Generate/Import

Paste the contents of the clipboard into the Value field, then enter a Name for the secret and create.

Grant Access to the Key Vault

Your data factory cannot use the secrets stored in your key vault until you grant it permission to do so. The data factory instance has an associated managed identity – a managed application registered in Azure Active Directory – which was created automatically when you created the data factory. You must grant access to this identity.

key vault and select Access policies

On the Access policies blade, locate and click the + Add Access Policy button

select Get and List from the Secret permissions

Under Select principal, click None selected

This opens the security principal selection blade

At the top of the blade is a search input field. An ADF managed identity service principal has the same name as the ADF instance it represents – enter the name of your data factory to search for the service principal. The search will return one matching item, as shown in the below figure. Click the item to choose it, then click the Select button at the bottom of the blade.

Create a Key Vault ADF Linked Service

Azure Data Factory accesses a key vault in exactly the same way it does other types of external resource: using a linked service. To refer to a key vault from within your data factory, you must create a linked service to represent it.

add a new linked service

then search for and select the Azure Key Vault data store. Click Continue

On the New linked service (Azure Key Vault) blade, provide a Name for the key vault linked service, then select your key vault from the Azure key vault name dropdown

Use the Test connection button to check the linked service configuration, and when successful, click Create

Create a New Storage Account Linked Service

create another new linked service, this time using the Azure Blob Storage data store

Ensure that Authentication method is set to “Account key,” then use the toggle below that field to change the connection type from “Connection string” to “Azure Key Vault.”

Select your key vault linked service from the AKV linked service dropdown, then enter the name of your storage account connection string secret.

Use the Test connection button to check the linked service configuration, and when successful, click Save.

The new linked service obtains credentials from the key vault at runtime, by obtaining the value of your named secret, authorized using the ADF instance’s managed identity

Cheers!
Uma

How to set up code repository for Azure Data Factory using Azure DevOps

First, if you don’t have an Azure DevOps account signup for free. Make sure you select the Default directory.

Create an organization and a project.

Organization - UmaAzure01
Project – azure_adf

Create a new Repository – Imagine a Repository is like a Parent Folder

 

Now go to Azure Data Factory and click on Set up code repository.

Here Collaboration branch means – the Final Code of the application. Usually, the main branch is set as a collaboration branch which is called as Main/Master Branch.

You can create multiple branches which are called a Feature Branch.

Branches will be merged with the master branch through Pull Request. The pull request is for approval for merging with the master.

Create a new working branch or you can use the main. In here ad_dev_branch1

Let’s create a pipeline and test. Create a pipeline under adf_dev_branch1 and saved it.

You can log in to the repository and create the Pull Request to merge

adf_dev_branch1 🡪 main

Approve the Pull Request and click on the complete button.

Once you the is completed, you can see changes in Main Branch in ADF

Cheers!
Uma