Skip to content

Commit 388a14a

Browse files
JillGrant615JillGrant615
authored
Merge pull request #52967 from MicrosoftDocs/UPDATE-configure-and-manage-azure-key-vault
Remove sandbox from configure-and-manage-azure-key-vault
2 parents 2dca148 + 16f4010 commit 388a14a

8 files changed

Lines changed: 332 additions & 325 deletions

File tree

‎learn-pr/azure/configure-and-manage-azure-key-vault/4-store-secrets-in-akv.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ metadata:
99
ms.author: mbaldwin
1010
ms.topic: unit
1111
durationInMinutes: 8
12-
azureSandbox: true
13-
interactive: powershell
12+
#azureSandbox: true
13+
#interactive: powershell
1414
content: |
1515
[!include[](includes/4-store-secrets-in-akv.md)]
1616

‎learn-pr/azure/configure-and-manage-azure-key-vault/includes/1-introduction.md‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
PetDash is an online pet food delivery company that provides store-to-door service for all their customer's pet needs. They take online orders, store credit cards and personal details in their SQL database, and have a secure website running on Azure App Service to interact with customers. They've been in business a little over a year. Steve, one of the website admins, noticed that their website certificate for the **petdash.com** domain has expired. Steve quickly renews the certificate, gets it installed on the server, and begins to explore ways to ensure that this problem never happens again. The investigation reveals that Azure Key Vault supports certificate management. Even better, Key Vault can communicate with App Service to provide the certification _and_ renew it automatically if necessary.
2-
3-
**Azure Key Vault** helps safeguard cryptographic keys and secrets that cloud applications and services use. Key Vault streamlines the key management process and enables you to maintain control of keys that access and encrypt your data. Developers can create keys for development and testing in minutes, and then migrate them to production keys. Security administrators can grant (and revoke) permission to keys, as needed.
4-
5-
## Learning objectives
6-
7-
In this module, you will:
8-
9-
- Explore proper usage of Azure Key Vault.
10-
- Manage access to an Azure Key Vault.
11-
- Explore certificate management with Azure Key Vault.
12-
- Configure a Hardware Security Module Key-generation solution.
1+
PetDash is an online pet food delivery company that provides store-to-door service for all their customer's pet needs. They take online orders, store credit cards and personal details in their SQL database, and have a secure website running on Azure App Service to interact with customers. They've been in business a little over a year. Steve, one of the website admins, noticed that their website certificate for the **petdash.com** domain has expired. Steve quickly renews the certificate, gets it installed on the server, and begins to explore ways to ensure that this problem never happens again. The investigation reveals that Azure Key Vault supports certificate management. Even better, Key Vault can communicate with App Service to provide the certification _and_ renew it automatically if necessary.
2+
3+
**Azure Key Vault** helps safeguard cryptographic keys and secrets that cloud applications and services use. Key Vault streamlines the key management process and enables you to maintain control of keys that access and encrypt your data. Developers can create keys for development and testing in minutes, and then migrate them to production keys. Security administrators can grant (and revoke) permission to keys, as needed.
4+
5+
## Learning objectives
6+
7+
In this module, you will:
8+
9+
- Explore proper usage of Azure Key Vault.
10+
- Manage access to an Azure Key Vault.
11+
- Explore certificate management with Azure Key Vault.
12+
- Configure a Hardware Security Module Key-generation solution.

‎learn-pr/azure/configure-and-manage-azure-key-vault/includes/2-key-vault-usage.md‎

Lines changed: 89 additions & 89 deletions
Large diffs are not rendered by default.

‎learn-pr/azure/configure-and-manage-azure-key-vault/includes/3-manage-access-and-permissions-to-secrets.md‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
1-
Key Vault access has two facets: the management of the Key Vault itself, and accessing the data contained in the Key Vault. Documentation refers to these facets as the *management plane* and the *data plane*.
2-
3-
These two areas are separated because the creation of the Key Vault is a management operation, while storing and retrieving a secret stored in the Key Vault is a different type of role. To access a key vault all users or apps must have proper *authentication* to identify the caller and *authorization* to determine the operations the caller can perform.
4-
5-
## Authentication
6-
7-
Azure Key Vault uses Microsoft Entra ID to authenticate users and apps that try to access a vault. Authentication is always performed by associating the request with the Microsoft Entra tenant of the subscription that the Key Vault is part of. Every user or app making a request must be known to Microsoft Entra ID. There's no support for anonymous access to a Key Vault.
8-
9-
## Authorization
10-
11-
Management operations (creating a new Azure Key Vault) use role-based access control (RBAC). There's a built-in role **Key Vault Contributor** that provides access to management features of key vaults, but it doesn't allow access to the key vault data. This role is the recommended role to use. There's also a **Contributor** role that includes full administration rights - including the ability to grant access to the data plane.
12-
13-
Reading and writing data in the Key Vault uses a separate Key Vault *access policy*. A Key Vault access policy is a permission set assigned to a user or managed identity to read, write, and/or delete secrets and keys. You can create an access policy using the CLI, REST API, or Azure portal as follows.
14-
15-
:::image type="content" source="../media/3-add-key-vault-policy.png" alt-text="Screenshot showing the Add KeyVault policy screen in the Azure portal.":::
16-
17-
The system has a list of predefined management options that define the permissions allowed for this policy. Here we've selected **Key, Secret, & Certificate Management**, which is appropriate to manage secrets in the Key Vault. You can then customize the permissions as desired by changing the **Key permissions** entries. For example, we could adjust the permissions to only allow *read* operations:
18-
19-
:::image type="content" source="../media/3-permissions.png" alt-text="Screenshot showing the permission list cut down to read only in the Azure portal.":::
20-
21-
Developers only need `Get` and `List` permissions to a development-environment vault. A lead or senior developer needs full permissions to the vault to change and add secrets when necessary. Full permissions to production-environment vaults are typically reserved for senior operations staff. Apps only require `Get` permissions as they often only need to retrieve secrets.
22-
23-
## Restrict network access
24-
25-
Another point to consider with Azure Key Vault is what services in your network can access the vault. In most cases, the network endpoints don't need to be open to the Internet. You should determine the minimum network access required. For example, you can restrict Key Vault endpoints to specific Azure Virtual Network subnets, specific IP addresses, or trusted Microsoft services. Services include Azure SQL, Azure App Service, and various data and storage services that use encryption keys.
26-
27-
:::image type="content" source="../media/3-network-rules.png" alt-text="Screenshot showing the network rules for a KeyVault in the Azure portal.":::
1+
Key Vault access has two facets: the management of the Key Vault itself, and accessing the data contained in the Key Vault. Documentation refers to these facets as the *management plane* and the *data plane*.
2+
3+
These two areas are separated because the creation of the Key Vault is a management operation, while storing and retrieving a secret stored in the Key Vault is a different type of role. To access a key vault all users or apps must have proper *authentication* to identify the caller and *authorization* to determine the operations the caller can perform.
4+
5+
## Authentication
6+
7+
Azure Key Vault uses Microsoft Entra ID to authenticate users and apps that try to access a vault. Authentication is always performed by associating the request with the Microsoft Entra tenant of the subscription that the Key Vault is part of. Every user or app making a request must be known to Microsoft Entra ID. There's no support for anonymous access to a Key Vault.
8+
9+
## Authorization
10+
11+
Management operations (creating a new Azure Key Vault) use role-based access control (RBAC). There's a built-in role **Key Vault Contributor** that provides access to management features of key vaults, but it doesn't allow access to the key vault data. This role is the recommended role to use. There's also a **Contributor** role that includes full administration rights - including the ability to grant access to the data plane.
12+
13+
Reading and writing data in the Key Vault uses a separate Key Vault *access policy*. A Key Vault access policy is a permission set assigned to a user or managed identity to read, write, and/or delete secrets and keys. You can create an access policy using the CLI, REST API, or Azure portal as follows.
14+
15+
:::image type="content" source="../media/3-add-key-vault-policy.png" alt-text="Screenshot showing the Add KeyVault policy screen in the Azure portal.":::
16+
17+
The system has a list of predefined management options that define the permissions allowed for this policy. Here we've selected **Key, Secret, & Certificate Management**, which is appropriate to manage secrets in the Key Vault. You can then customize the permissions as desired by changing the **Key permissions** entries. For example, we could adjust the permissions to only allow *read* operations:
18+
19+
:::image type="content" source="../media/3-permissions.png" alt-text="Screenshot showing the permission list cut down to read only in the Azure portal.":::
20+
21+
Developers only need `Get` and `List` permissions to a development-environment vault. A lead or senior developer needs full permissions to the vault to change and add secrets when necessary. Full permissions to production-environment vaults are typically reserved for senior operations staff. Apps only require `Get` permissions as they often only need to retrieve secrets.
22+
23+
## Restrict network access
24+
25+
Another point to consider with Azure Key Vault is what services in your network can access the vault. In most cases, the network endpoints don't need to be open to the Internet. You should determine the minimum network access required. For example, you can restrict Key Vault endpoints to specific Azure Virtual Network subnets, specific IP addresses, or trusted Microsoft services. Services include Azure SQL, Azure App Service, and various data and storage services that use encryption keys.
26+
27+
:::image type="content" source="../media/3-network-rules.png" alt-text="Screenshot showing the network rules for a KeyVault in the Azure portal.":::

‎learn-pr/azure/configure-and-manage-azure-key-vault/includes/4-store-secrets-in-akv.md‎

Lines changed: 105 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,105 @@
1-
To get some quick experience with Azure Key Vault, let's create a new Key Vault and do the most basic operation available: store a secret. Creating a vault in the Azure portal requires no initial configuration. Your signed-in user identity is automatically granted the full set of secret management permissions, and you can start adding secrets immediately. Once you have a vault, adding and managing secrets can be done from any Azure administrative interface, including the Azure portal, the Azure CLI, and Azure PowerShell.
2-
3-
## Create a new Azure Key Vault
4-
5-
Let's start by creating a new Key Vault in the Azure portal.
6-
7-
1. Sign in to the [Azure portal](https://portal.azure.com?azure-portal=true) using the same credentials you used to activate the Azure Sandbox.
8-
9-
1. Select **Create a resource**. The **Create a resource** pane appears.
10-
11-
1. In the **Search services and marketplace**, search for and select *Key Vault* to find the Azure Key Vault service. The **Key Vault** pane appears.
12-
13-
1. Select **Create**. The **Create key vault** pane appears.
14-
15-
1. On the **Basics** tab, enter the following values for each setting.
16-
17-
| Setting | Value |
18-
|---|---|
19-
| **Project details** |
20-
| Subscription | From the dropdown, select *Concierge Subscription*. |
21-
| Resource group | From the dropdown, select <rgn>[sandbox resource group name]</rgn>. |
22-
| **Instance details** |
23-
| Key vault name | Enter a globally unique name for the new vault. Vault names must be 3-24 characters long and contain only alphanumeric characters and dashes. The exercise uses the example name of *VaultamortDiary* for the new vault.
24-
| Region | Accept default. |
25-
| Pricing tier | Accept default. |
26-
27-
1. Select **Review + create**.
28-
29-
1. After validation passes, select **Create** to create the Azure Key Vault.
30-
31-
After the deployment is complete, select **Go to resource**. Your *Key vault* pane appears.
32-
33-
## Add a secret
34-
35-
Next, add a new secret to the vault.
36-
37-
1. In the left menu pane, under **Objects**, select **Secrets**. The **Secrets** pane appears for your key vault.
38-
39-
1. In the top menu bar, select **Generate/Import**. The **Create a secret** pane appears.
40-
41-
1. Enter a name, value, and (optional) content type. An example follows.
42-
43-
:::image type="content" source="../media/1-create-secret.png" alt-text="Screenshot showing the Create a secret pane in the Azure portal for Azure Key Vault.":::
44-
45-
1. Select **Create** to add the secret. The **Secrets** pane reappears.
46-
47-
## Show the secret
48-
49-
Finally, verify that the secret value has been set.
50-
51-
1. Select your secret from the list. The **Versions** pane appears for your secret.
52-
53-
1. Select the **CURRENT VERSION** of the secret. The **Secret Version** pane appears.
54-
55-
1. Select **Show Secret Value** to see the value assigned to the secret.
56-
57-
:::image type="content" source="../media/1-show-secret.png" alt-text="Screenshot showing the secret value in the Azure portal.":::
58-
59-
## Other ways to consume the secret
60-
61-
You can create and retrieve secrets from the Azure Key Vault as long as you're authenticated with Microsoft Entra ID using the REST API, native SDKs, Azure CLI, or Azure PowerShell. For example, here's the same process using Azure PowerShell.
62-
63-
```powershell
64-
Get-AzKeyVault
65-
```
66-
67-
This command returns the created vault with the name **VaultamortDiary**.
68-
69-
```output
70-
Vault Name : VaultamortDiary
71-
Resource Group Name : Learn-4f01665a-1272-46a8-9c16-83bbf146494e
72-
Region : northcentralus
73-
Resource ID : /subscriptions/xyz/providers/Microsoft.KeyVault/vaults/VaultamortDiary
74-
```
75-
76-
With the name of the vault and the key, you can retrieve the secret value:
77-
78-
```powershell
79-
Get-AzKeyVaultSecret -VaultName 'VaultamortDiary' -Name 'HiddenLocation'
80-
```
81-
82-
This command returns our set value:
83-
84-
```output
85-
Vault Name : vaultamortdiary
86-
Name : VaultamortDiary
87-
Version : ff4b23af35bf4ba9a5c8792227d00ff6
88-
Id : https://vaultamortdiary1972.vault.azure.net:44
89-
3/secrets/VaultamortDiary/ff4b23af35bf4ba9
90-
a5c8792227d00ff6
91-
Enabled : True
92-
Expires :
93-
Not Before :
94-
Created : 12/17/2020 7:54:03 PM
95-
Updated : 12/17/2020 7:54:03 PM
96-
Content Type : text
97-
Tags :
98-
```
99-
100-
> [!NOTE]
101-
> The module [Manage secrets in your server apps with Azure Key Vault](/training/modules/manage-secrets-with-azure-key-vault/) shows how to use the Azure CLI and various programming languages to create Key Vaults, set, and retrieve secrets.
1+
To get some quick experience with Azure Key Vault, let's create a new Key Vault and do the most basic operation available: store a secret. Creating a vault in the Azure portal requires no initial configuration. Your signed-in user identity is automatically granted the full set of secret management permissions, and you can start adding secrets immediately. Once you have a vault, adding and managing secrets can be done from any Azure administrative interface, including the Azure portal, the Azure CLI, and Azure PowerShell.
2+
3+
[!INCLUDE[](../../../includes/azure-optional-exercise-subscription-note.md)]
4+
5+
[!INCLUDE[](../../../includes/azure-optional-exercise-create-resource-group-note.md)]
6+
7+
## Create a new Azure Key Vault
8+
9+
Let's start by creating a new Key Vault in the Azure portal.
10+
11+
1. Sign in to the [Azure portal](https://portal.azure.com?azure-portal=true) using the same credentials you used to activate the Azure Sandbox.
12+
13+
1. Select **Create a resource**. The **Create a resource** pane appears.
14+
15+
1. In the **Search services and marketplace**, search for and select *Key Vault* to find the Azure Key Vault service. The **Key Vault** pane appears.
16+
17+
1. Select **Create**. The **Create key vault** pane appears.
18+
19+
1. On the **Basics** tab, enter the following values for each setting.
20+
21+
| Setting | Value |
22+
|---|---|
23+
| **Project details** |
24+
| Subscription | From the dropdown, select your subscription. |
25+
| Resource group | From the dropdown, select your resource group. |
26+
| **Instance details** |
27+
| Key vault name | Enter a globally unique name for the new vault. Vault names must be 3-24 characters long and contain only alphanumeric characters and dashes. The exercise uses the example name of *VaultamortDiary* for the new vault.
28+
| Region | Accept default. |
29+
| Pricing tier | Accept default. |
30+
31+
1. Select **Review + create**.
32+
33+
1. After validation passes, select **Create** to create the Azure Key Vault.
34+
35+
After the deployment is complete, select **Go to resource**. Your *Key vault* pane appears.
36+
37+
## Add a secret
38+
39+
Next, add a new secret to the vault.
40+
41+
1. In the left menu pane, under **Objects**, select **Secrets**. The **Secrets** pane appears for your key vault.
42+
43+
1. In the top menu bar, select **Generate/Import**. The **Create a secret** pane appears.
44+
45+
1. Enter a name, value, and (optional) content type. An example follows.
46+
47+
:::image type="content" source="../media/1-create-secret.png" alt-text="Screenshot showing the Create a secret pane in the Azure portal for Azure Key Vault.":::
48+
49+
1. Select **Create** to add the secret. The **Secrets** pane reappears.
50+
51+
## Show the secret
52+
53+
Finally, verify that the secret value has been set.
54+
55+
1. Select your secret from the list. The **Versions** pane appears for your secret.
56+
57+
1. Select the **CURRENT VERSION** of the secret. The **Secret Version** pane appears.
58+
59+
1. Select **Show Secret Value** to see the value assigned to the secret.
60+
61+
:::image type="content" source="../media/1-show-secret.png" alt-text="Screenshot showing the secret value in the Azure portal.":::
62+
63+
## Other ways to consume the secret
64+
65+
You can create and retrieve secrets from the Azure Key Vault as long as you're authenticated with Microsoft Entra ID using the REST API, native SDKs, Azure CLI, or Azure PowerShell. For example, here's the same process using Azure PowerShell.
66+
67+
```powershell
68+
Get-AzKeyVault
69+
```
70+
71+
This command returns the created vault with the name **VaultamortDiary**.
72+
73+
```output
74+
Vault Name : VaultamortDiary
75+
Resource Group Name : Learn-4f01665a-1272-46a8-9c16-83bbf146494e
76+
Region : northcentralus
77+
Resource ID : /subscriptions/xyz/providers/Microsoft.KeyVault/vaults/VaultamortDiary
78+
```
79+
80+
With the name of the vault and the key, you can retrieve the secret value:
81+
82+
```powershell
83+
Get-AzKeyVaultSecret -VaultName 'VaultamortDiary' -Name 'HiddenLocation'
84+
```
85+
86+
This command returns our set value:
87+
88+
```output
89+
Vault Name : vaultamortdiary
90+
Name : VaultamortDiary
91+
Version : ff4b23af35bf4ba9a5c8792227d00ff6
92+
Id : https://vaultamortdiary1972.vault.azure.net:44
93+
3/secrets/VaultamortDiary/ff4b23af35bf4ba9
94+
a5c8792227d00ff6
95+
Enabled : True
96+
Expires :
97+
Not Before :
98+
Created : 12/17/2020 7:54:03 PM
99+
Updated : 12/17/2020 7:54:03 PM
100+
Content Type : text
101+
Tags :
102+
```
103+
104+
> [!NOTE]
105+
> The module [Manage secrets in your server apps with Azure Key Vault](/training/modules/manage-secrets-with-azure-key-vault/) shows how to use the Azure CLI and various programming languages to create Key Vaults, set, and retrieve secrets.

0 commit comments

Comments
 (0)