How do I hide my Storage and SQL connection strings using Azure Cloud Services?

Question

I would like to move the Storage and SQL connection string from configuration files stored in the various projects of my solution to only be accessible in the Azure Portal.

Keeping connection strings in source control means that if anyone got a look at our code base they would have unlimited access to our Azure accounts.

In Azure Web Sites the connection strings can be set in the portal and will be kept when the next deployment occurs. Is it possible to do the same with Cloud Services?

Answer 1

No, it is not possible. A cloud service is a VM, it is not an application that can consume connection strings.

If you have a continuous integration server, what you can do is this: before you deploy your app into the cloud service, run a script that changes the value of the connection string to what you like, and deploy that. In this way, the connection string is only visible in your CI server and not in your code.

Note however that if you already committed the connection strings to your codebase, there's no way to remove them from the history. (Unless you do a force push, which is not recommended).

Answer 2

This should be now possible with Azure Key Vault. I haven't tried it - but plan to - but here's a good tutorial on getting started with key vault and then using key vault from a web app. Whether this works exactly the same for Cloud Services I'm not sure.