Getting Started with Azure Key Vault

PS:> $secretvalue = ConvertTo-SecureString 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxyxxxxxxxxxxxxxxxxxxxx==' -AsPlainText –Force
PS:> Set-AzureKeyVaultSecret -VaultName 'BhushanKeyVault' -Name 'BhushanDemoStoragePrimaryKey' -SecretValue $secretvalue

Note that we are converting the access key to secure string and then storing it in key vault using above cmdlets.

Now that we have added the access key in the key vault, let’s create a web application which consumes this secret from key vault.

I will create a MVC web application and simple after creating it I will hit F5 so that it runs in IIS express giving me it’s URL which I will need to add in Azure active directory.

Suppose my application is running on URL – http://locahost:49993/

We will need to add this application in Azure active directory so that it can be given privileges to access Azure key vault.

Browse to Azure active directory in your subscription and click on applications tab.

Click on the add button to register the application in AD

As this is a demo app so I won’t be paying much attention to required metadata.

Click ok and your application will be added to AD and you will be redirected to dashboard of it.

Click on the configure tab and note down the client ID, we will be using it later in this article.

Also, on the same tab – browse to keys section and select duration, once you save your changes – you will be shown the key.

Now the application is registered with active directory, however our key vault still is unaware of our application so let’s go ahead and introduce them to each other.

I have used below PowerShell command which grants all permission to web application so that read all keys and secrets in our key vault. You can control these permissions and grant only those permissions to applications which are required by them.

Set-AzureRmKeyVaultAccessPolicy -VaultName 'BhushanKeyVault' -ServicePrincipalName ‘xxxxxxxx-xxxx-xxxx-xxxx-6eb4e8975211' -PermissionsToKeys all -PermissionsToSecrets all –ResourceGroupName 'BhushanKeyVaultRG'

And now key vault knows our web application and allows it to read stored keys and secret.

Now let’s go ahead and write some code in our web application.

First, install below nuggets packages in the solution, one is to communicate to Azure AD and other is to perform azure key vault related actions.

And

Also let’s add few entries in our web configuration files as,

Note that ClientId is set to the value which was shown as ClientID shown in the azure active directory and client secret is set to key value generated after setting and saving duration on same page in Azure AD.

For this demo, we can take a look at pre-built library shared at and use it to speed up things. It shows how basic actions to azure key vault can be performed. ( I have used some of the code from this library).

I have copied few classes from the HelloKeyVault.csproj to our web application project, copied some helper functions like GetAccessToken and GetHttpClient, also installed System.Net.Http.Formatting nugget.

Add a DemoController and Index view and modify default routing of the application. We will be adding our logic in this action method which will fetch stored secret.

public class DemoController : Controller  
{  
  public ActionResult Index()  
  {  
    var vaultAddress = WebConfigurationManager.AppSettings["VaultUrl"];  
  
    // Register authentication call back - this would be executed for any request to Azure key vault.  
              
    KeyVaultClient keyVaultClient = new KeyVaultClient(new        KeyVaultClient.AuthenticationCallback(GetAccessToken));  
  
   var secret = keyVaultClient.GetSecretAsync(vaultAddress, "BhushanDemoStoragePrimaryKey", null).GetAwaiter().GetResult();  
  
   var storagePrimaryAccessKey = secret.Value;  
  
   return View();  
  }  
  
  public static async Task<string> GetAccessToken(string authority, string resource, string scope)  
  {  
    var clientId = WebConfigurationManager.AppSettings["AuthClientId"];  
    var clientSecret = WebConfigurationManager.AppSettings["AuthClientSecret"];  
    ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);  
  
    var context = new AuthenticationContext(authority, TokenCache.DefaultShared);  
    var result = await context.AcquireTokenAsync(resource, clientCredential);  
  
    return result.AccessToken;  
  }  
 }  
}

Code is quite self-explanatory, we are reading Client Id and secret from web configuration file and using it to get the access token from the authenticating authority.

Note that this is not the best way to get the authentication token, there is certificate based mechanism which you can use to achieve the same. You can take a look at the pre-built library for more explanation.

Once the above code is set and application is deployed on azure, later even if vault administrator or power user changes the value of secret (e.g. by rotating storage access key periodically) it doesn’t impact the application and it will always read the latest value of storage access key.

Logging in Azure Key Vault

Now that you have created key vault and started adding your keys and secrets in it, you might want to monitor when and who is accessing your secure data.

Logging works in similar to the way SQL Azure creates logs, i.e. in Azure storage.

Since we have already created our storage account, we will use the same for storing key vault logs.

Once we configure logging in key vault, a container named ‘insights-logs-auditevent’ is created in specified azure storage.

Retention and access to the information stored in a container has to be managed by you e.g. using standard protection techniques.

Let’s set up logging to our Azure key vault

PS:> $keyvault = Get-AzureRmKeyVault -VaultName 'BhushanKeyVault'
PS:> $storageaccount = Get-AzureRmStorageAccount -StorageAccountName 'bhushandemostorage'

You can get the key vault resource Id and storage account Id using above parameters e.g.

$keyvault.ResourceId and $storageaccount.Id

We will be using these parameters in next command

Set-AzureRmDiagnosticSetting -ResourceId '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/BhushanKeyVaultRG/providers/Microsoft.KeyVault/vaults/BhushanKeyVault' -StorageAccountId '/subscriptions/xxxxxxxx-xxxxx-xxxxx-xxxx-xxxxxxxxxxx/resourceGroups/bhushankeyvaultrg/providers/Microsoft.Storage/storageAccounts/bhushandemostorage' -Enabled $true -Categories AuditEvent

Now the logging has been enabled on azure key vault.

What is logged

• All authenticated REST API requests will be logged. (including access denied requests).
• Actions on key vault e.g. creation, deletion, setting key value access policies etc
• Actions on the keys and secrets e.g. encrypt, decrypt, sign, verify etc.

Let’s access the secret stored in key vault using our web application again and see what information is logged in the logging container.

It stores a JSON record in a deep nested structure of containers,

If you explore the container and take a look at the JSON log file, you will observe that Information like request Uri, client IP address etc. information is logged.

Read more articles on Azure:

• Overview Of MVC 6 and Deployment On Azure
• Azure Media Services Overview And Playing Media