MS Azure Intermediate: Managing a Key Vault

Name: MS Azure Intermediate: Managing a Key Vault
Author: Steven Burnley

Examine the capabilities of a key vault in an Azure subscription.

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

In this lesson, I'll show you what the capabilities of the Azure Key Vault are and common scenarios for why you may need one in your Azure Cloud subscription, as well as explore the options that we have when creating an Azure Key Vault. The Azure Key Vault is a technology used in your cloud subscription to provide a secure storage location for information that must remain private. Many times, solutions, such as web applications, require secure credentials to access resources, or they possess certificates or encryption keys to encrypt data or encrypt network communication. The information, such as a database connection string, needs to be kept in a secure location for the application to retrieve at runtime to provide access to these resources, but this information should not be compromised for inappropriate use. If we take a look at the idea of a certificate being used in a browser transaction, we would be examining the process of HTTPS or SSL communication. Almost all visits to websites are done through the browser request beginning with HTTPS. The S is requesting a secure socket layer, or SSL, connection. This requires the web server to present a certificate that has been issued by a certificate authority. This certificate is then validated by the client and that allows the server to prove its authentic identity. Certificate authentication is very common on the internet, but these certificates must be kept in a secure location so that they cannot be compromised. This is an example of a reason to use the Azure Key Vault as a secure storage location for these issued certificates. While certificates are used to encrypt data being transferred across a network, you may also need to store keys related to encrypting data. This would be another use for the Azure Key Vault. A process called Transparent Data Encryption is used by Azure to encrypt data when it resides on discs on the Azure Cloud. This protects customer data. While certificates from a certificate authority are used to encrypt data being transferred over a network, there is another opportunity to encrypt data when it's being stored on disc. Encrypting data when it is stored on discs uses a technology called data encryption keys. These keys can be generated for you by Microsoft and it allows Microsoft to manage this process for you. There are some certain industries that require customers to manage their own data encryption keys. If this is a scenario that applies to you, the Azure Key Vault is an appropriate place to store these keys. In addition to storing keys for encrypting data at rest, another reason to use the Azure Key Vault is to encrypt settings that might be used by applications, such as web applications. The third use for the Azure Key Vault is to store credentials that may be used by a web application to access external resources, such as a data store. a web server would need to authenticate with the data tier in a three-tier web application, as described in this diagram. You can see a web browser client or smartphone is connecting to a web app over the internet. In our case, this web app would be hosted in Microsoft Azure. The database could be a SQL database, or SQL database, which also resides in the Azure Cloud. The web application would need a connection string that would include the location of the server and the credentials in order to authenticate with the server. This would give the web application access to the data that it needs. This is done through a database connection string, as seen in the Azure portal. This is a database hosted in Azure, called order entry, and you see an example of a text-based connection string. This is the credential that the application would need to authenticate with the server. You would have to substitute the appropriate password. It is not displayed on the screen for security purposes. These three uses for the key vault, which would be certificates issued by a certificate authority for encrypting network data, or data encryption keys used to encrypt data at rest, or secure credentials needed by web applications, such as connection strings. These three resources can be stored in a resource like the Azure Key Vault. In this diagram, you can see that an Azure web application would need to authenticate with the Azure Key Vault while it's running in order to access these secure pieces of information. This diagram also shows that the web app would need to authenticate with Azure Active Directory. That means that as a developer developing a web application that needs to use the Azure Key Vault, you will need to make sure that your web application has the appropriate permissions to access resources in the key vault, and we'll set that up as part of our key vault installation. If we want to manage the key vaults that are part of this Azure subscription, we first need to search for key vault up in the search box at the top of the screen. Let's do that now. You can see that key vault is presented as an option, so let's select that. You can see that the subscription does not have a key vault created yet. Let's take a look at some of the options related to creating key vaults. We can see that, as with all Azure resources, we must first select a resource group in order to store this resource. In addition to selecting the resource group where the key vault should be created, we must also enter in a valid name for the key vault. This does need to be a unique name across your Azure subscription. As with many Azure resources, you must select the appropriate region around the world that you would like to create this resource. You should create this resource in the same region as your web application would be located. You can also see that there are recovery options at the bottom of the screen related to how long keys should be protected in case they are deleted from the key vault. These are important credentials that may be necessary for the functioning of web applications, and in scenarios where these are accidentally deleted, you can see there is protection to store these values for up to 90 days to allow them to be recovered by an Azure administrator. You can see that these can be stored for up to 90 days to be recovered by an Azure administrator. If we click next at the bottom of the screen, we'll be able to view the access control permissions for the vault. You can see that the only person who will have permissions to use this key vault is the creator of the key vault. There are no roles or groups within Azure that are given permissions to the key vault. This means that it is already starting with only a single user having permissions to manage it. This actually means that other Azure administrators will not be able to view or manage this key vault unless they are added to the access policy list at the bottom of this screen. This creates the most secure environment for your key vault. In addition to limiting who would have permissions to look at your key vault, if we change to the networking tab, we can also see that we can limit access to your key vault from a networking perspective. This allows you to ensure that your key vault is only accessible from the appropriate web applications that need to look up settings from your key vault and not accessible from locations such as the internet or other locations within your Azure Cloud where you may have other solutions deployed. Stay tuned for the next lesson, where I will show you how to create a key vault and manipulate some key vault settings, such as storing a database connection string. Thanks for watching.

Intermediate Provider : Steven Burnley 3 Lessons · 27m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

These lessons explore key vaults, what they are, and how they are used to protect critical security information. You will explore how a key vault stores and provides secure access to certificates, encryption keys, and application settings such as database connection strings. The key vault is a secure location, and we will examine its default security settings and how to adjust them for your organizational needs.

By learning about key vault settings, you can grant additional administrators or application services the ability to set or retrieve settings from the vault. A common use for key vaults is securing application configuration information, such as connection strings for web applications. In these lessons, we will go over the steps to configuring a web application to retrieve settings from a key vault. You will learn how to create the key vault secret and how to set the appropriate application identity, allowing you to grant permissions to the web app to retrieve the secret you’ve set up.

What You'll Learn

Explore the purpose of key vault resources and how they protect critical security information
Deploy and create a key vault to securely store certificates, encryption keys, and application settings
Manage a key vault by reviewing and adjusting its default security settings for your organizational needs
Grant additional administrators or application services permission to set or retrieve settings from the vault
Configure a web application to retrieve settings, such as connection strings, from a key vault
Create a key vault secret and set the appropriate application identity to grant the web app retrieval permissions

Key Takeaways

A key vault stores and provides secure access to certificates, encryption keys, and application settings such as database connection strings.
The key vault is a secure location with default security settings that can be adjusted to fit organizational needs.
Key vault settings let you grant additional administrators or application services the ability to set or retrieve vault settings.
A common use for key vaults is securing application configuration information, such as connection strings for web applications.
Configuring a web app to use a key vault involves creating the key vault secret and setting the appropriate application identity to grant retrieval permissions.

Frequently Asked Questions

What does this course cover?

It explores what key vaults are and how they protect critical security information, including how a key vault stores and provides secure access to certificates, encryption keys, and application settings such as database connection strings. It also covers default security settings, adjusting them, and configuring a web application to retrieve settings from a key vault.

What will I learn to do with key vaults?

The learning objectives are to explore key vault resources, deploy a key vault, and manage a key vault.

How is a key vault used with web applications?

A common use is securing application configuration information, such as connection strings for web applications. The course covers the steps to configure a web application to retrieve settings from a key vault, including creating the key vault secret and setting the appropriate application identity to grant the web app permission to retrieve the secret.

What lessons are included in this course?

The course includes three lessons: Exploring the Purpose of a Key Vault, Creating a Key Vault, and Accessing a Key Vault From a Web Application.

What skills does this course help build?

It addresses skills including Access Keys, Azure Security, Data Vaults, Enterprise Vault, Key Management, and Microsoft Security Essentials.