Key Lifecycle Management in Azure

Key Lifecycle Management (KLM) is a crucial aspect of cryptographic key management, ensuring the secure generation, distribution, usage, and retirement of cryptographic keys. In the context of Azure, a cloud computing platform by Microsoft, Key Vault provides a robust solution for managing cryptographic keys and secrets, offering advanced features for key lifecycle management.

Understanding KLM

Generation

In Azure Key Vault, keys can be generated using various algorithms and key sizes based on your security requirements.

# Powershell

$key = New-AzKeyVaultKey -VaultName 'YourKeyVault' -Name 'KeyName' -KeyType 'RSA' -KeySize 2048

# Python

key_client = KeyClient(vault_url='https://YourKeyVault.vault.azure.net/', credential=credential)
key = key_client.create_rsa_key('KeyName', size=2048)

Storage

Keys need to be securely stored to prevent unauthorized access. Azure Key Vault encrypts keys at rest and allows the configuration of access policies.

Set-AzKeyVaultAccessPolicy -VaultName 'YourKeyVault' -ResourceGroupName 'YourResourceGroup' -ObjectId 'YourUserOrAppObjectId' -PermissionsToKeys all

1. -VaultName 'YourKeyVault':
   • Specifies the name of the Azure Key Vault where the access policy is being set.
2. -ResourceGroupName 'YourResourceGroup':
   • Specifies the name of the resource group containing the Azure Key Vault.
   • The resource group is a logical container for resources deployed in Azure.
3. -ObjectId 'YourUserOrAppObjectId':
   • Specifies the Object ID of the user, group, or application for which the access policy is applied.
   • The Object ID uniquely identifies the user, group, or application within Azure Active Directory (Azure AD).
4. -PermissionsToKeys all:
   • Specifies the permissions granted for keys.
   • In this example, the access policy grants all permissions for keys (all).

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

# Key Vault configuration
vault_url = "https://YourKeyVaultName.vault.azure.net/"
resource_group = "YourResourceGroup"
object_id = "YourUserOrAppObjectId"
permissions_to_keys = ["all"]

# Authenticate to Azure Key Vault
credential = DefaultAzureCredential()
secret_client = SecretClient(vault_url=vault_url, credential=credential)

# Set Access Policy
secret_client.set_access_control(
    {
        "object_id": object_id,
        "permissions": {"keys": permissions_to_keys}
    }
)

1. vault_url = "https://YourKeyVaultName.vault.azure.net/":
   • Specifies the URL of the Azure Key Vault where the access policy is being set.
2. resource_group = "YourResourceGroup":
   • Specifies the name of the resource group containing the Azure Key Vault.
   • The resource group is a logical container for resources deployed in Azure.
3. object_id = "YourUserOrAppObjectId":
   • Specifies the Object ID of the user, group, or application for which the access policy is applied.
   • The Object ID uniquely identifies the user, group, or application within Azure Active Directory (Azure AD).
4. permissions_to_keys = ["all"]:
   • Specifies the permissions granted for keys.
   • In this example, the access policy grants all permissions for keys (all).
5. Authenticate to Azure Key Vault:
   • The DefaultAzureCredential is used to authenticate to Azure Key Vault using the application’s identity.
6. Set Access Policy:
   • The set_access_control method is used to set the access policy for the specified user, group, or application.
   • The access control dictionary includes the object_id and permissions for keys.

Permissions Granted by all:

The permissions granted by setting ["all"] for keys in this example are similar to the PowerShell example:

• get
• create
• delete
• list
• update
• backup
• restore
• recover
• purge
• import

Usage

Keys are used for encryption, decryption, signing, and verification. Azure Key Vault allows applications to retrieve keys for cryptographic operations securely.

Here an example in Python: https://prodata.engineering/connect-a-python-app-to-azure-key-vault-and-cosmodb/

Rotation

Regularly rotating keys enhances security. Azure Key Vault supports automated key rotation.

# Powershell

$key = Get-AzKeyVaultKey -VaultName 'YourKeyVault' -KeyName 'KeyName'
Update-AzKeyVaultKey -VaultName 'YourKeyVault' -ResourceGroupName 'YourResourceGroup' -KeyVersion $key.Key.Kid

# Python

key_client.rotate_key('KeyName')

Retirement/Deletion

Retiring or deleting keys is essential when they are no longer needed. Azure Key Vault supports soft-delete, allowing recovery within a retention period.

#Powershell

Remove-AzKeyVaultKey -VaultName 'YourKeyVault' -KeyName 'KeyName'

# Python

key_client.begin_delete_key('KeyName')

Audit/Logging

Key Vault provides comprehensive audit logs, enabling organizations to monitor key access and operations. For example we can use Aure Portal to monitor Key Valuts.

To Recap (Powershell, Python, C++)

Key Generation:

Key Storage:

Key Usage:

Key Rotation:

Key Retirement/Deletion: