-->

Nov 07, 2016  Azure Key Vault is a cloud-hosted cryptographic keys and secrets store. This video takes a quick walkthrough on how you can get started with Key Vault. I am planning to keep keys on key vault, but I am not clear about versioning of keys and secrets, I have some question about versioning of key/secret on Azure key vault. How to create new version of existing key? Is it possible to decrypt data encrypted with different version of same key? Use Azure Key Vault to encrypt keys and small secrets like passwords that use keys stored in hardware security modules (HSMs). For more assurance, import or generate keys in HSMs and Microsoft processes your keys in FIPS 140-2 Level 2 validated HSMs (hardware and firmware). With Key Vault, Microsoft doesn’t see or extract your keys. Nov 27, 2019  Azure Key Vault Explorer. Contribute to microsoft/AzureKeyVaultExplorer development by creating an account on GitHub.

Introduction

After you have a key vault, you can start using it to store keys and secrets. Your applications no longer need to persist your keys or secrets, but can request them from the vault as needed. A key vault allows you to update keys and secrets without affecting the behavior of your application, which opens up a breadth of possibilities for your key and secret management.

This article walks through how to implement a scheduled rotation of storage account keys, monitor the key vault audit logs, and raise alerts when unexpected requests are made.

You must first create a key vault using the method of your choice:

Store a secret

To enable an application to retrieve a secret from Key Vault, you must first create the secret and upload it to your vault.

Start an Azure PowerShell session and sign in to your Azure account with the following command:

In the pop-up browser window, enter the username and password for your Azure account. PowerShell will get all the subscriptions that are associated with this account. PowerShell uses the first one by default.

If you have multiple subscriptions, you might have to specify the one that was used to create your key vault. Enter the following to see the subscriptions for your account:

To specify the subscription that's associated with the key vault you'll be logging, enter:

Because this article demonstrates storing a storage account key as a secret, you must get that storage account key.

After retrieving your secret (in this case, your storage account key), you must convert that key to a secure string, and then create a secret with that value in your key vault.

Next, get the URI for the secret you created. You'll need this URI in a later step to call the key vault and retrieve your secret. Run the following PowerShell command and make note of the ID value, which is the secret's URI:

Set up the application

Now that you have a secret stored, you can use code to retrieve and use it after performing a few more steps.

First, you must register your application with Azure Active Directory. Then tell Key Vault your application information so that it can allow requests from your application.

Note

Your application must be created on the same Azure Active Directory tenant as your key vault.

  1. Open Azure Active Directory.

  2. Select App registrations.

  3. Select New application registration to add an application to Azure Active Directory.

  4. Under Create, leave the application type as Web app / API and give your application a name. Give your application a Sign-on URL. This URL can be anything you want for this demo.

  5. After the application is added to Azure Active Directory, the application page opens. Select Settings, and then select Properties. Copy the Application ID value. You'll need it in later steps.

Next, generate a key for your application so it can interact with Azure Active Directory. To create a key, select Keys under Settings. Make note of the newly generated key for your Azure Active Directory application. You'll need it in a later step. The key won't be available after you leave this section.

Before you establish any calls from your application into the key vault, you must tell the key vault about your application and its permissions. The following command uses the vault name and the application ID from your Azure Active Directory app to grant the application Get access to your key vault.

You're now ready to start building your application calls. In your application, you must install the NuGet packages that are required to interact with Azure Key Vault and Azure Active Directory. From the Visual Studio Package Manager console, enter the following commands. At the writing of this article, the current version of the Azure Active Directory package is 3.10.305231913, so confirm the latest version and update as needed.

In your application code, create a class to hold the method for your Azure Active Directory authentication. In this example, that class is called Utils. Add the following using statement:

Next, add the following method to retrieve the JWT token from Azure Active Directory. For maintainability, you might want to move the hard-coded string values into your web or application configuration.

Add the necessary code to call Key Vault and retrieve your secret value. First, you must add the following using statement:

Add the method calls to invoke Key Vault and retrieve your secret. In this method, you provide the secret URI that you saved in a previous step. Note the use of the GetToken method from the Utils class you created previously.

When you run your application, you should now be authenticating to Azure Active Directory and then retrieving your secret value from Azure Key Vault.

Key rotation using Azure Automation

Important

Azure Automation runbooks still require the use of the AzureRM module.

You are now ready to set up a rotation strategy for the values you store as Key Vault secrets. Secrets can be rotated in several ways:

  • As part of a manual process
  • Programmatically by using API calls
  • Through an Azure Automation script

For the purposes of this article, you'll use PowerShell combined with Azure Automation to change an Azure storage account's access key. You'll then update a key vault secret with that new key.

To allow Azure Automation to set secret values in your key vault, you must get the client ID for the connection named AzureRunAsConnection. This connection was created when you established your Azure Automation instance. To find this ID, select Assets from your Azure Automation instance. From there, select Connections, and then select the AzureRunAsConnection service principal. Make note of the ApplicationId value.

In Assets, select Modules. Select Gallery, and then search for and import updated versions of each of the following modules:

Note

At the writing of this article, only the previously noted modules needed to be updated for the following script. Windows 98 key generator download free. If your automation job fails, confirm that you've imported all necessary modules and their dependencies.

After you've retrieved the application ID for your Azure Automation connection, you must tell your key vault that this application has permission to update secrets in your vault. Use the following PowerShell command:

Next, select Runbooks under your Azure Automation instance, and then select Add Runbook. Select Quick Create. Name your runbook, and select PowerShell as the runbook type. You can add a description. Finally, select Create.

Paste the following PowerShell script in the editor pane for your new runbook:

In the editor pane, select Test pane to test your script. After the script runs without error, you can select Publish, and then you can apply a schedule for the runbook in the runbook configuration pane.

Key Vault auditing pipeline

When you set up a key vault, you can turn on auditing to collect logs on access requests made to the key vault. These logs are stored in a designated Azure storage account and can be pulled out, monitored, and analyzed. The following scenario uses Azure functions, Azure logic apps, and key-vault audit logs to create a pipeline that sends an email when an app that doesn't match the app ID of the web app retrieves secrets from the vault.

First, you must enable logging on your key vault. Use the following PowerShell commands. (You can see the full details in this article about key-vault-logging.)

After logging is enabled, audit logs start being stored in the designated storage account. These logs contain events about how and when your key vaults are accessed, and by whom.

Note

You can access your logging information 10 minutes after the key vault operation. It will often be available sooner than that.

The next step is to create an Azure Service Bus queue. This queue is where key-vault audit logs are pushed. When the audit-log messages are in the queue, the logic app picks them up and acts on them. Create a Service Bus instance with the following steps:

  1. Create a Service Bus namespace (if you already have one that you want to use, skip to step 2).
  2. Browse to the Service Bus instance in the Azure portal and select the namespace you want to create the queue in.
  3. Select Create a resource > Enterprise Integration > Service Bus, and then enter the required details.
  4. Find the Service Bus connection information by selecting the namespace and then selecting Connection Information. You'll need this information for the next section.

Next, create an Azure function to poll the key vault logs within the storage account and pick up new events. This function will be triggered on a schedule.

To create an Azure function app, select Create a resource, search the marketplace for Function App, and then select Create. During creation, you can use an existing hosting plan or create a new one. You can also opt for dynamic hosting. For more information about the hosting options for Azure Functions, see How to scale Azure Functions.

After the Azure function app is created, go to it, and select the Timer scenario and C# for the language. Then select Create this function.

On the Develop tab, replace the run.csx code with the following:

Note

Change the variables in the preceding code to point to your storage account where the key vault logs are written, to the Service Bus instance you created earlier, and to the specific path to the key-vault storage logs.

The function picks up the latest log file from the storage account where the key vault logs are written, grabs the latest events from that file, and pushes them to a Service Bus queue.

Because a single file can have multiple events, you should create a sync.txt file that the function also looks at to determine the time stamp of the last event that was picked up. Using this file ensures that you don't push the same event multiple times.

The sync.txt file contains a time stamp for the last-encountered event. When the logs are loaded, they must be sorted based on their time stamps to ensure that they're ordered correctly.

For this function, we reference a couple additional libraries that aren't available out of the box in Azure Functions. To include these libraries, we need Azure Functions to pull them by using NuGet. Under the Code box, select View Files.

Add a file called project.json with the following content:

After you select Save, Azure Functions will download the required binaries.

Switch to the Integrate tab and give the timer parameter a meaningful name to use within the function. In the preceding code, the function expects the timer to be called myTimer. Specify a CRON expression for the timer as follows: 0 * * * * *. This expression will cause the function to run once a minute.

On the same Integrate tab, add an input of the type Azure Blob storage. This input will point to the sync.txt file that contains the time stamp of the last event looked at by the function. This input will be accessed within the function by using the parameter name. In the preceding code, the Azure Blob storage input expects the parameter name to be inputBlob. Select the storage account where the sync.txt file will be located (it could be the same or a different storage account). In the path field, provide the path to the file in the format {container-name}/path/to/sync.txt.

Add an output of the type Azure Blob storage. This output will point to the sync.txt file you defined in the input. This output is used by the function to write the time stamp of the last event looked at. The preceding code expects this parameter to be called outputBlob.

The function is now ready. Make sure to switch back to the Develop tab and save the code. Check the output window for any compilation errors and correct them as needed. If the code compiles, then the code should now be checking the key vault logs every minute and pushing any new events into the defined Service Bus queue. You should see logging information write out to the log window every time the function is triggered.

Azure logic app

Next, you must create an Azure logic app that picks up the events that the function is pushing to the Service Bus queue, parses the content, and sends an email based on a condition being matched.

Create a logic app by selecting Create a resource > Integration > Logic App.

After the logic app is created, go to it and select Edit. In the logic app editor, select Service Bus Queue and enter your Service Bus credentials to connect it to the queue.

Select Add a condition. In the condition, switch to the advanced editor and enter the following code. Replace APP_ID with the actual app ID of your web app:

This expression essentially returns false if the appid from the incoming event (which is the body of the Service Bus message) isn't the appid of the app.

Now, create an action under IF NO, DO NOTHING.

For the action, select Office 365 - send email. Fill out the fields to create an email to send when the defined condition returns false. If you don't have Office 365, look for alternatives to achieve the same results.

You now have an end-to-end pipeline that looks for new key-vault audit logs once a minute. It pushes new logs it finds to a Service Bus queue. The logic app is triggered when a new message lands in the queue. If the appid within the event doesn't match the app ID of the calling application, it sends an email.

-->

Azure Key Vault helps solve the following problems:

  • Secrets Management - Azure Key Vault can be used to Securely store and tightly control access to tokens, passwords, certificates, API keys, and other secrets
  • Key Management - Azure Key Vault can also be used as a Key Management solution. Azure Key Vault makes it easy to create and control the encryption keys used to encrypt your data.
  • Certificate Management - Azure Key Vault is also a service that lets you easily provision, manage, and deploy public and private Transport Layer Security/Secure Sockets Layer (TLS/SSL) certificates for use with Azure and your internal connected resources.
  • Store secrets backed by Hardware Security Modules - The secrets and keys can be protected either by software or FIPS 140-2 Level 2 validated HSMs

Why use Azure Key Vault?

Centralize application secrets

Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked. When using Key Vault, application developers no longer need to store security information in their application. Not having to store security information in applications eliminates the need to make this information part of the code. For example, an application may need to connect to a database. Instead of storing the connection string in the app's code, you can store it securely in Key Vault.

Windows 8.1 Enterprise-N. Download windows 8.1 product key generator Windows 8 Enterprise. Windows Server 2012 R-2 Data-center. Windows 8 Professional-N.

Azure Key Vault Access

Your applications can securely access the information they need by using URIs. These URIs allow the applications to retrieve specific versions of a secret. There is no need to write custom code to protect any of the secret information stored in Key Vault.

Securely store secrets and keys

Secrets and keys are safeguarded by Azure, using industry-standard algorithms, key lengths, and hardware security modules (HSMs). The HSMs used are Federal Information Processing Standards (FIPS) 140-2 Level 2 validated.

Access to a key vault requires proper authentication and authorization before a caller (user or application) can get access. Authentication establishes the identity of the caller, while authorization determines the operations that they are allowed to perform.

Authentication is done via Azure Active Directory. Authorization may be done via role-based access control (RBAC) or Key Vault access policy. RBAC is used when dealing with the management of the vaults and key vault access policy is used when attempting to access data stored in a vault.

Azure Key Vaults may be either software- or hardware-HSM protected. For situations where you require added assurance you can import or generate keys in hardware security modules (HSMs) that never leave the HSM boundary. Microsoft uses nCipher hardware security modules. You can use nCipher tools to move a key from your HSM to Azure Key Vault.

Secret

Finally, Azure Key Vault is designed so that Microsoft does not see or extract your data.

Monitor access and use

Once you have created a couple of Key Vaults, you will want to monitor how and when your keys and secrets are being accessed. You can monitor activity by enabling logging for your vaults. You can configure Azure Key Vault to:

  • Archive to a storage account.
  • Stream to an event hub.
  • Send the logs to Azure Monitor logs.

You have control over your logs and you may secure them by restricting access and you may also delete logs that you no longer need.

Simplified administration of application secrets

When storing valuable data, you must take several steps. Security information must be secured, it must follow a life cycle, and it must be highly available. Azure Key Vault simplifies the process of meeting these requirements by:

  • Removing the need for in-house knowledge of Hardware Security Modules.
  • Scaling up on short notice to meet your organization's usage spikes.
  • Replicating the contents of your Key Vault within a region and to a secondary region. Data replication ensures high availability and takes away the need of any action from the administrator to trigger the failover.
  • Providing standard Azure administration options via the portal, Azure CLI and PowerShell.
  • Automating certain tasks on certificates that you purchase from Public CAs, such as enrollment and renewal.

In addition, Azure Key Vaults allow you to segregate application secrets. Applications may access only the vault that they are allowed to access, and they can be limited to only perform specific operations. You can create an Azure Key Vault per application and restrict the secrets stored in a Key Vault to a specific application and team of developers.

Integrate with other Azure services

As a secure store in Azure, Key Vault has been used to simplify scenarios like:

  • The always encrypted functionality in SQL server and Azure SQL Database
  • Azure App Service.

Create Secret In Azure Key Vault

Key Vault itself can integrate with storage accounts, event hubs, and log analytics.

Azure Key Vault Auto Generate Secrets

Next steps