Security Engineering in Azure: Azure Key Vault Overview

Microsoft Azure offers a cloud service called Azure Key Vault that is intended to manage and safely store private data, including cryptographic keys, secrets, and certificates that are utilized by cloud services and apps. In addition to providing strong security features like access control, encryption, and auditing to protect sensitive data, it serves as a centralized repository. Secrets for application settings, certificates for communication security, and cryptographic keys for encryption and decryption are all managed and deployed more easily by developers and administrators with the aid of Azure Key Vault. This service offers a specialized, scalable solution for key and secret management in a cloud context, enhancing the security posture of Azure applications.

Why use the Azure Key Vault?

Using Azure Key Vault offers several benefits for secure and efficient management of sensitive information in a cloud environment:

1. Centralized Management: Azure Key Vault provides a centralized platform for managing cryptographic keys, secrets, and certificates. This simplifies the overall management process and ensures consistent security practices.
2. Security: Key Vault employs industry-standard encryption protocols and hardware security modules (HSMs) to safeguard sensitive data. This helps protect against unauthorized access and ensures that cryptographic operations are performed in a secure environment.
3. Access Control: Role-based access control (RBAC) allows fine-grained control over who can access and manage keys and secrets. This ensures that only authorized personnel have the necessary permissions.
4. Compliance: Azure Key Vault assists in meeting regulatory and compliance requirements by providing secure storage and management of cryptographic keys and secrets. This is crucial for industries with strict data protection standards.
5. Scalability: As cloud applications grow, the demand for managing cryptographic assets also increases. Azure Key Vault is designed to scale with your application, providing a reliable and scalable solution for key and secret management.
6. Secure Application Development: Integrating Key Vault into applications allows developers to securely store and retrieve sensitive information, promoting best practices for security in application development.
7. Key Lifecycle Management: Key Vault simplifies the key lifecycle management process, including key rotation, versioning, and key retirement. This ensures that cryptographic keys are regularly updated and secure.
8. Audit Trails: Key Vault logs all access and operations, providing detailed audit trails. This helps in monitoring and tracking who accessed or modified sensitive information, aiding in compliance and security assessments.

Look here to get more specs about Azure Key Vault.

Azure Key Vault Object Identifier

Azure Key Vault allows you to use Object Identifiers (OIDs) to uniquely identify various cryptographic objects stored in the vault, such as keys, secrets, and certificates. When you create these objects in Key Vault, they are assigned a unique OID, and you can use this identifier to manage and access the specific object.

Let’s take a look in Powershell, Python. and C++

Powershell

# Powershell azureKeyVault.ps1

# Azure Key Vault configuration
$vaultName = "YourKeyVaultName"
$resourceGroup = "YourResourceGroupName"

# Connect to Azure Key Vault
Connect-AzAccount
$vault = Get-AzKeyVault -VaultName $vaultName -ResourceGroupName $resourceGroup

# Create a new key in Azure Key Vault
$keyName = "YourNewKey"
$key = Add-AzKeyVaultKey -VaultName $vaultName -Name $keyName -Destination 'software'

# Get the Object Identifier (OID) of the created key
$keyObjectId = (Get-AzKeyVaultKey -VaultName $vaultName -Name $keyName).Id
Write-Host "Key Object Identifier (OID): $keyObjectId"

For a testing environment, you can use Jupyter Notebook with Powershell Kernel. This allows you to create a markdown notebook to document the process and the results of your developed code. Here a guide on how to setup your VS Code to run Powershell in your Jupyter Notebook: https://powershellisfun.com/2022/08/04/jupyter-notebooks-in-vscode-with-powershell-support/

Python

# Python azureKeyVault.py

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from azure.keyvault.keys import KeyClient

# Azure Key Vault configuration
vault_url = "https://YourKeyVaultName.vault.azure.net/"

# Authenticate to Azure Key Vault
credential = DefaultAzureCredential()
secret_client = SecretClient(vault_url=vault_url, credential=credential)
key_client = KeyClient(vault_url=vault_url, credential=credential)

# Create a new key in Azure Key Vault
key_name = "YourNewKey"
key = key_client.create_rsa_key(key_name)

# Get the Object Identifier (OID) of the created key
key_properties = key_client.get_key(key_name)
key_object_id = key_properties.id
print(f"Key Object Identifier (OID): {key_object_id}")

C++

// C++ azureKeyVault.hpp

#include <iostream>
#include <azure/identity.hpp>
#include <azure/keyvault/secrets.hpp>
#include <azure/keyvault/keys.hpp>

// Azure Key Vault configuration
std::string vaultUrl = "https://YourKeyVaultName.vault.azure.net/";

// Authenticate to Azure Key Vault
auto credential = Azure::Identity::DefaultAzureCredential();
auto secretClient = Azure::KeyVault::Secrets::SecretClient(vaultUrl, credential);
auto keyClient = Azure::KeyVault::Keys::KeyClient(vaultUrl, credential);

// Create a new key in Azure Key Vault
std::string keyName = "YourNewKey";
auto key = keyClient.CreateRsaKey(keyName);

// Get the Object Identifier (OID) of the created key
auto keyProperties = keyClient.GetKey(keyName);
auto keyObjectId = keyProperties.Id;
std::cout << "Key Object Identifier (OID): " << keyObjectId << std::endl;

Azure Key Vault for Hardware Security Modules (HSMs)

Azure Key Vault doesn’t typically expose Object Identifiers (OIDs) for Hardware Security Modules (HSMs) directly through its public APIs. However, you can interact with the Azure Key Vault HSM service using various SDKs and libraries provided by Azure. Below are examples in PowerShell, Python, and C++ for working with Azure Key Vault using the Azure SDK.

Powershell

# Install Azure PowerShell Module
Install-Module -Name Az -Force -AllowClobber

# Sign in to your Azure account
Connect-AzAccount

# Set your Azure Key Vault details
$resourceGroupName = "YourResourceGroupName"
$keyVaultName = "YourKeyVaultName"

# Get the Key Vault details
$keyVault = Get-AzKeyVault -VaultName $keyVaultName -ResourceGroupName $resourceGroupName

# Display details, including the HSM information
$keyVault.Properties

Python

from azure.identity import DefaultAzureCredential
from azure.keyvault.keys import KeyClient

# Set your Azure Key Vault details
vault_url = "https://YourKeyVaultName.vault.azure.net/"

# Authenticate to Azure Key Vault
credential = DefaultAzureCredential()
key_client = KeyClient(vault_url=vault_url, credential=credential)

# Get the Key Vault details, including HSM information
key_vault_properties = key_client.get_properties_of_key_vault()
print(key_vault_properties)

Be sure to install the required Python packages

pip install azure-identity azure-keyvault-keys

C++

#include <iostream>
#include <azure/identity.hpp>
#include <azure/keyvault/keys.hpp>

// Set your Azure Key Vault details
std::string vaultUrl = "https://YourKeyVaultName.vault.azure.net/";

// Authenticate to Azure Key Vault
auto credential = Azure::Identity::DefaultAzureCredential();
auto keyClient = Azure::KeyVault::Keys::KeyClient(vaultUrl, credential);

// Get the Key Vault details, including HSM information
auto keyVaultProperties = keyClient.GetPropertiesOfKeyVault();
std::cout << keyVaultProperties << std::endl;

Remember that to get the Azure C++ components you need to:

1. Install CMake in your enviroment. You can download it at https://cmake.org/
2. Use Git to clone the Azure SDK for C++ repository from GitHub https://github.com/Azure/azure-sdk-for-cpp
3. Build the SDK
4. You can install the SDK system-wide (if desired) using the bash command sudo make install
5. Include Azure SDK in your C++ project. In your CMakeLists.txt file, you can include the Azure SDK for C++ components

Here an example of CMakeLists.txt file:

cmake_minimum_required(VERSION 3.10)

project(YourProject)

find_package(azure-storage-blobs REQUIRED)

add_executable(YourExecutable main.cpp)
target_link_libraries(YourExecutable PRIVATE Azure::azure-storage-blobs)

DNS Suffix

Object Types

• Cryptographic keys: Supports multiple key types and algorithms, and enables the use of software-protected and HSM-protected keys. For more information, see About keys.
• Secrets: Provides secure storage of secrets, such as passwords and database connection strings. For more information, see About secrets.
• Certificates: Supports certificates, which are built on top of keys and secrets and add an automated renewal feature. Keep in mind when a certificate is created, an addressable key and secret are also created with the same name. For more information, see About certificates.
• Azure Storage account keys: Can manage keys of an Azure Storage account for you. Internally, Key Vault can list (sync) keys with an Azure Storage Account, and regenerate (rotate) the keys periodically. For more information, see Manage storage account keys with Key Vault.

Objects, identifiers, and versioning

Objects stored in Key Vault are versioned whenever a new instance of an object is created. Each version is assigned a unique object identifier. When an object is first created, it’s given a unique version identifier and marked as the current version of the object. Creation of a new instance with the same object name gives the new object a unique version identifier, causing it to become the current version.

Objects in Key Vault can be retrieved by specifying a version or by omitting the version to get the latest version of the object. Performing operations on objects requires providing a version to use specific version of the object.

Key Vault Properties