You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is accomplished by configuring a KMS provider resource with the `azurekeyvault`
12
+
provider and other provider-specific parameter values.
13
+
14
+
The following sections describe how to properly configure the secrets engine to enable
15
+
the functionality.
16
+
17
+
Refer to the [setup guide](/vault/docs/secrets/key-management/azurekeyvault/setup) for CLI command examples.
18
+
19
+
## Authentication
20
+
21
+
You need to configure the key management secrets engine with credentials that have sufficient
22
+
permissions to manage keys in an Azure Key Vault instance. The [credentials](/vault/api-docs/secret/key-management/azurekeyvault#credentials) section of the API documentation describes the authentication parameters. The authentication parameters will be set with the following order
3.[Managed Service Identity (MSI)](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview)
28
+
29
+
If the client ID or secret are not provided and Vault is running on an Azure VM, Vault will attempt
30
+
to use MSI to access Azure. Note that when MSI is used, the tenant ID must still be explicitly provided by the configuration or environment variable.
31
+
32
+
An Azure Key Vault [access policy](https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy-portal) determines whether a given service principal, namely an application or user group, can perform certain operations on a Key Vault instance. The service principal associated with the provided credentials must have an access policy on the Key Vault instance with the following minimum key permissions:
33
+
34
+
-`create`
35
+
-`delete`
36
+
-`get`
37
+
-`import`
38
+
-`update`
39
+
40
+
<Tiptitle="Use Terraform">
41
+
42
+
If you are familiar with Terraform, you can use it to deploy the necessary Azure infrastructure. Refer to the [Terraform example](/vault/docs/secrets/key-management/azurekeyvault/setup#terraform-example) section.
43
+
44
+
</Tip>
45
+
46
+
## Key transfer specification
47
+
48
+
Keys are securely transferred from the secrets engine to Azure key vault instances in accordance
49
+
with the Azure [Bring Your Own Key](https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification)
50
+
specification.
51
+
52
+
## Key purpose compatibility
53
+
54
+
The following table defines which key [purposes](/vault/api-docs/secret/key-management#purpose) can be used
55
+
for each key type supported by Azure Key Vault KMS.
This is accomplished by configuring a KMS provider resource with the `azurekeyvault`
12
-
provider and other provider-specific parameter values.
13
-
14
-
The following sections describe how to properly configure the secrets engine to enable
15
-
the functionality.
16
-
17
-
## Authentication
18
-
19
-
You need to configure the Key Management secrets engine with credentials that have sufficient
20
-
permissions to manage keys in an Azure Key Vault instance. The [credentials](/vault/api-docs/secret/key-management/azurekeyvault#credentials) section of the API documentation describes the authentication parameters. The authentication parameters will be set with the following order
3.[Managed Service Identity (MSI)](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview)
26
-
27
-
If the client ID or secret are not provided and Vault is running on an Azure VM, Vault will attempt
28
-
to use MSI to access Azure. Note that when MSI is used, the tenant ID must still be explicitly provided by the configuration or environment variable.
29
-
30
-
An Azure Key Vault [access policy](https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy-portal) determines whether a given service principal, namely an application or user group, can perform certain operations on a Key Vault instance. The service principal associated with the provided credentials must have an access policy on the Key Vault instance with the following minimum key permissions:
31
-
32
-
-`create`
33
-
-`delete`
34
-
-`get`
35
-
-`import`
36
-
-`update`
37
-
38
-
<Tiptitle="Use Terraform">
39
-
40
-
If you are familiar with Terraform, you can use it to deploy the necessary Azure infrastructure. Refer to the [Terraform example](#terraform-example) section.
41
-
42
-
</Tip>
7
+
# Setup guide - Azure Key Vault
43
8
9
+
To manage the lifecycle of the Azure Key Vault keys, you need to setup the
10
+
key management secrets engine using `azurekeyvault` provider.
44
11
45
12
## Setup
46
13
47
-
1. Enable the secrets engine.
14
+
1. Enable the key management secrets engine.
48
15
49
16
```shell-session
50
17
$ vault secrets enable keymgmt
@@ -64,47 +31,70 @@ If you are familiar with Terraform, you can use it to deploy the necessary Azure
64
31
65
32
The command specified the following:
66
33
67
-
- The full path to this KMS provider instance in Vault (`keymgmt/kms/example-kms`).
68
-
- A key collection, which corresponds to the name of the key vault instance in Azure.
34
+
- The full path to this KMS provider instance in Vault
35
+
(`keymgmt/kms/example-kms`).
36
+
- A key collection, which corresponds to the name of the key vault instance
37
+
in Azure.
69
38
- The KMS provider is set to `azurekeyvault`.
70
-
- Azure client ID credential, that can also be specified with `AZURE_CLIENT_ID` environment variable.
71
-
- Azure client secret credential, that can also be specified with `AZURE_CLIENT_SECRET `environment variable.
72
-
- Azure tenant ID credential, that can also be specified with `AZURE_TENANT_ID` environment variable.
39
+
- Azure client ID credential, that can also be specified with
40
+
`AZURE_CLIENT_ID` environment variable.
41
+
- Azure client secret credential, that can also be specified with
42
+
`AZURE_CLIENT_SECRET `environment variable.
43
+
- Azure tenant ID credential, that can also be specified with
44
+
`AZURE_TENANT_ID` environment variable.
73
45
74
46
<Tiptitle="API documentation">
75
47
76
-
Refer to the Azure Key Vault [API documentation](/vault/api-docs/secret/key-management/azurekeyvault) for a detailed description of individual configuration parameters.
48
+
Refer to the Azure Key Vault [API
49
+
documentation](/vault/api-docs/secret/key-management/azurekeyvault) for a
50
+
detailed description of individual configuration parameters.
77
51
78
52
</Tip>
79
53
80
54
## Usage
81
55
82
-
1. Write a pair of RSA-2048 keys to the secrets engine. The following command will write a new key of type **rsa-2048** to the path `keymgmt/key/rsa-1`.
56
+
1. Write a pair of RSA-2048 keys to the secrets engine. The following command
57
+
will write a new key of type **rsa-2048** to the path `keymgmt/key/rsa-1`.
83
58
84
59
```shell-session
85
60
$ vault write keymgmt/key/rsa-1 type="rsa-2048"
86
61
Success! Data written to: keymgmt/key/rsa-1
87
62
```
88
63
89
-
The Key Management secrets engine currently supports generation of the key types specified in [Key Types](/vault/docs/secrets/key-management#key-types).
64
+
The key management secrets engine currently supports generation of the key
Based on the [Compatibility](/vault/docs/secrets/key-management#compatibility) section of the documentation, Azure Key Vault currently supports use of RSA-2048, RSA-3072, and RSA-4096 key types.
68
+
Based on the
69
+
[Compatibility](/vault/docs/secrets/key-management#compatibility) section of
70
+
the documentation, Azure Key Vault currently supports use of RSA-2048,
71
+
RSA-3072, and RSA-4096 key types.
92
72
93
-
1. Read the **rsa-1** key you created. Use JSON as the output and pipe that into `jq`.
73
+
1. Read the **rsa-1** key you created. Use JSON as the output and pipe that into
74
+
`jq`.
94
75
95
76
```shell-session
96
77
$ vault read -format=json keymgmt/key/rsa-1 | jq
97
78
```
98
79
99
-
1. To use the keys you wrote, you must distribute them to the key vault. Distribute the **rsa-1** key to the key vault at the path `keymgmt/kms/example-kms/key/rsa-1`.
80
+
1. To use the keys you wrote, you must distribute them to the key vault.
81
+
Distribute the **rsa-1** key to the key vault at the path
82
+
`keymgmt/kms/example-kms/key/rsa-1`.
100
83
101
84
```shell-session
102
85
$ vault write keymgmt/kms/example-kms/key/rsa-1 \
103
86
purpose="encrypt,decrypt" \
104
87
protection="hsm"
105
88
```
106
89
107
-
Here you are instructing Vault to distribute the key and specify that its purpose is only to encrypt and decrypt. The protection type is dependent on the cloud provider and the value is either `hsm` or `software`. In the case of Azure, you specify `hsm` for the protection type. The key will be securely delivered to the key vault instance according to the [Azure Bring Your Own Key](https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification) (BYOK) specification.
90
+
Here you are instructing Vault to distribute the key and specify that its
91
+
purpose is only to encrypt and decrypt. The protection type is dependent on
92
+
the cloud provider and the value is either `hsm` or `software`. In the case
93
+
of Azure, you specify `hsm` for the protection type. The key will be
94
+
securely delivered to the key vault instance according to the [Azure Bring
The secrets engine can be configured to communicate with Azure Key Vault instances
152
-
using [Azure Private Endpoints](https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview).
153
-
Follow the guide at [Integrate Key Vault with Azure Private Link](https://docs.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal)
154
-
to set up a Private Endpoint for your target Key Vault instance in Azure. The Private Endpoint must
155
-
be network reachable by Vault. This means Vault needs to be running in the same virtual network or
156
-
a peered virtual network to properly resolve the Key Vault domain name to the Private Endpoint IP
157
-
address.
158
-
159
-
The Private Endpoint configuration relies on a correct [Azure Private DNS](https://docs.microsoft.com/en-us/azure/dns/private-dns-overview)
125
+
The secrets engine can be configured to communicate with Azure Key Vault
integration. From the host that Vault is running on, follow the steps in
161
-
[Validate that the private link connection works](https://docs.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal#validate-that-the-private-link-connection-works)
162
-
to ensure that the Key Vault domain name resolves to the Private Endpoint IP address you've configured.
0 commit comments