Azure Secrets +

Azure Key Vault integration for BoxLang system settings via the azure. namespace in getSystemSetting().

This module is only available to +/++ subscribers only, and requires a valid bx-plus license.

The bx-azure-secrets module registers an azure system setting provider so BoxLang can resolve secrets directly from Azure Key Vault using getSystemSetting().

✨ Features

• Resolve secrets with getSystemSetting( "azure.SECRET-NAME" )
• 3-tier configuration resolution per setting: this.azure in Application.bx, module settings, then Azure environment variables/default credentials
• In-memory TTL caching to reduce Key Vault API calls
• Per-application SecretClient isolation when this.azure is defined
• Automatic client cleanup on application shutdown
• Graceful fallback behavior: returns null on provider errors so normal getSystemSetting() fallback continues

📦 Requirements

• BoxLang 1.14+
• bx-plus module
• Azure identity with Key Vault secrets/get permission

🚀 Installation

Via CommandBox

box install bx-plus,bx-azure-secrets

Via BoxLang OS Binary

install-bx-module bx-plus bx-azure-secrets

⚡ Quick Start

1. Install and activate bx-plus and bx-azure-secrets
2. Configure credentials through this.azure, module settings, or Azure DefaultAzureCredential
3. Resolve secrets with azure. namespaced keys

dbPassword = getSystemSetting( "azure.DB-PASSWORD" )
apiKey = getSystemSetting( "azure.API-KEY", "fallback-key" )

⚙️ Basic Configuration

Use module settings in boxlang.json when you want global defaults:

{
  "modules": {
    "bxazure-secrets": {
      "settings": {
        "vaultUrl": "https://my-vault.vault.azure.net/",
        "tenantId": "",
        "clientId": "",
        "clientSecret": "",
        "cacheTTL": 300
      }
    }
  }
}

The module id for installation is bx-azure-secrets, while module settings are keyed under bxazure-secrets.

For per-app overrides and Azure CLI examples, see Configuration & Usage.

🔍 How Secret Resolution Works

For getSystemSetting( "azure.MY-SECRET" ), the provider:

1. Resolves effective Azure settings (3-tier lookup)
2. Checks in-memory cache using vaultUrl:secretName
3. Calls Azure Key Vault when cache is stale/missing
4. Caches and returns the secret value
5. Returns null on lookup failure, allowing standard BoxLang fallback behavior

🔗 Related Documentation

Configuration & UsageModulesPlus Core