Design for keyvault

Azure Key Vault is a secure vault designed to store and manage keys, secrets, and certificates for your applications. It offers three essential functions: key management, certificate management, and secret management.

Why Use Azure Key Vault?

Storing sensitive data in Azure Key Vault eliminates the need to embed credentials or encryption keys directly in your code. Your application can securely retrieve these elements at runtime. Key Vault provides robust access control using Azure Role-Based Access Control (RBAC) alongside its own data plane access policies. Even with RBAC permissions, explicit access policies are required to modify or read stored data. This separation enhances security by centralizing auditing and logging for all operations, making it easier to detect credential leaks or unauthorized access.

Azure Key Vault also streamlines key generation within the cloud, reducing the challenges of on-premises key management. Multiple Key Vaults can be deployed to meet distinct access policies or to improve performance under high request volumes.

Setting Up Azure Key Vault and Managing Identities on the Azure Portal

Creating an App Registration

Begin by setting up an identity for your application through Azure Active Directory to securely access Key Vault.

1. Open the Azure Portal and navigate to Azure Active Directory.
2. Under App Registrations, create a new registration (for example, "KodeKloud").
3. After registration, copy the Application (client) ID and the Directory (tenant) ID for later use.
4. Go to the Certificates & Secrets section and create a new client secret. Remember to copy the secret value immediately, as it will be hidden later.

Creating a Key Vault and Adding a Secret

1. In the Azure Portal, create a new Key Vault. Ensure the name is unique as it forms part of a public endpoint.
2. Configure additional settings such as soft delete and retention policies according to your needs.
3. After deployment, navigate to the Key Vault resource and select Secrets.
4. Create a new secret (for example, "SQL DB") by providing a secret value along with optional fields like activation and expiration dates.

Configuring Access Policies

Even with RBAC management permissions, accessing secrets in Key Vault requires explicit data plane access policies.

1. In your Key Vault, navigate to Access Policies.
2. Click Create and select the appropriate permissions (for example, grant all secret permissions when working with secrets).
3. Search for and select the app registration (e.g., "KodeKloud") that you created earlier.
4. Confirm the settings and create the access policy.

Development with Visual Studio Code

After completing the Key Vault setup and configuring access policies, you can write and test code to interact with Key Vault using Visual Studio Code. Its robust development features, such as autocomplete and an integrated terminal, facilitate this process.

Retrieving a Token and Accessing Secrets Using PowerShell

The following PowerShell code snippet demonstrates how to retrieve an Azure AD token using client credentials and use that token to access a secret stored in Azure Key Vault.

# Get token from Azure AD using client credentials
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Content-Type", "application/x-www-form-urlencoded")
$body = "grant_type=client_credentials&client_id=<your-client-id>&client_secret=<your-client-secret>&resource=https://vault.azure.net/"
$tenantId = "<your-tenant-id>"
$url = "https://login.microsoftonline.com/$tenantId/oauth2/token"
$output = Invoke-RestMethod -Uri $url -Body $body -Method POST -Headers $headers
$accessToken = $output.access_token

# Access a secret from Azure Key Vault
$secretId = "https://yourkeyvaultname.vault.azure.net/secrets/your-secret-name?api-version=7.3"
$akvHeaders = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$akvHeaders.Add("Authorization", "Bearer $accessToken")
$secret = Invoke-RestMethod -Uri $secretId -Method GET -Headers $akvHeaders
$secret.value

When executed (for example, within an Automation Account runbook), this script retrieves and prints the secret value from Key Vault.

Securing Access with Managed Identity

To enhance security and eliminate embedded credentials, you can enable a Managed Identity for your Automation Account. Managed Identity provides your application with a secure mechanism to acquire tokens without managing client IDs or secrets manually.

Enabling Managed Identity

1. In your Automation Account within the Azure Portal, navigate to the Identity section.
2. Enable the system-assigned managed identity.
3. Once the identity is enabled, note its object ID. Use this ID to grant access in Key Vault by creating a dedicated access policy.

Using Managed Identity with PowerShell

Below is an example PowerShell script demonstrating how to use Managed Identity to retrieve an access token and then access a secret from Key Vault without explicitly handling credentials.

# Get token from Managed Identity Service (MSI)
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$resource = "resource=https://vault.azure.net"
# The environment variable IDENTITY_HEADER contains the MSI endpoint URL
$url = $env:IDENTITY_HEADER + $resource
$headers.Add("X-IDENTITY-HEADER", $env:IDENTITY_HEADER)
$headers.Add("Metadata", "True")
$tokenResponse = Invoke-RestMethod -Uri $url -Method GET -Headers $headers
$accessToken = $tokenResponse.access_token

# Access the Key Vault secret using the MSI token
$secretId = "https://yourkeyvaultname.vault.azure.net/secrets/your-secret-name?api-version=7.3"
$akvHeaders = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$akvHeaders.Add("Authorization", "Bearer $accessToken")
$secret = Invoke-RestMethod -Uri $secretId -Method GET -Headers $akvHeaders
$secret.value

After updating Key Vault access policies to include your Automation Account’s managed identity, this script should successfully return the secret value without storing any credentials in your code.

Final Remarks

By combining managed identities with Azure Key Vault, you can eliminate hard-coded credentials in your automation scripts and significantly improve your application’s secret management security. This guide has walked you through setting up Key Vault, configuring access policies, and building PowerShell scripts to retrieve secrets—first using client credentials and then leveraging a managed identity.

Evaluate these approaches carefully to meet your specific security and performance requirements as you build and secure your Azure environment.

Happy coding!