Controlling Secret Access in Dapr

Dapr's secret scoping feature lets you control which specific secrets applications can access within a secret store. Instead of giving apps access to all secrets, you can implement fine-grained permissions using allowedSecrets and deniedSecrets lists.

How It Works

Configure secret access through Dapr's Configuration resource:

apiVersion: dapr.io/v1alpha1 kind: Configuration metadata: name: ecommerce-config spec: secrets: scopes: - storeName: azure-keyvault defaultAccess: deny allowedSecrets: ["payment-api-key", "shipping-webhook-secret"] - storeName: redis-secrets defaultAccess: allow deniedSecrets: ["admin-token"] 

Key Rules

• allowedSecrets takes priority - only listed secrets are accessible
• deniedSecrets blocks specific secrets while allowing others
• Lists override the defaultAccess setting

Common Patterns

Whitelist approach (recommended for production):

defaultAccess: deny allowedSecrets: ["service-specific-secrets"] 

Blacklist approach (good for development):

defaultAccess: allow deniedSecrets: ["sensitive-admin-secrets"] 

This feature helps implement least-privilege access without changing your application code - just apply the configuration to your Dapr sidecar.