Key Vault as Connection-Secret Source

Overview

This is a reusable child flow that centralizes secret retrieval for every FlowLibs automation. A parent flow calls it with a caller identity and a secret name; the flow authorizes the request against two allowlists, fetches the value from Azure Key Vault at runtime, writes an audit row to Dataverse, and returns the secret to the caller. No secret value is ever stored in a flow definition or an environment variable in plaintext.

Why it matters: secrets hardcoded in flows or kept in plain environment variables leak through exports and run history. A single governed retrieval pattern keeps every secret in Key Vault, enforces who may fetch what, and produces a tamper-evident audit trail.

Ships Off (Stopped). In production, mark the response output secure so the value is not logged in run history.

Use Case

Many flows need API keys or connection strings (e.g. to call a third-party REST API). Instead of each flow storing its own secret, they call this one child flow over HTTP. It confirms the caller and the requested secret are both allow-listed, retrieves the value from Key Vault only when both checks pass, and logs every request - authorized or denied - with the secret name only (never the value).

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Wire up a parent flow

Call this flow's HTTP trigger with {caller, secretName}; read secretValue from the response.

Expand the allowlists

Add caller identities to flowlibs_AllowedCallers and secret names to flowlibs_SecretNameAllowlist.

Secret versioning

Swap GetSecret for GetSecretVersion to pin a specific version.

Harden the response

Mark the Response output secure; optionally return a reference/handle rather than the raw value.

Alerting

Add a Teams/Outlook notification in the Denied branch for security review.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

and(contains(variables('varAllowedCallers'), variables('varCaller')), contains(variables('varSecretAllowlist'), variables('varRequestedSecret')))

body('Get_Secret_From_Key_Vault')?['value']

triggerBody()?['caller']  |  triggerBody()?['secretName']

guid()