Introduction to Azure Key Vault

In this article, we will see:

• What is a Key Vault.
• How to create a Key Vault.
• How to manage a Key Vault (Create new Keys, Add Secrets, Manage access policies).

Key Vault

Azure Key Vault is a Microsoft’s Cloud security scheme, where you can securely put your Keys and Secrets. Key Vault uses a software (uses Azure VM) and hardware Security Modules (uses HSM).

Key: It is a cryptographic key. RSA 2048.
Secret: Any sequence of bytes under 25KB. Ex. Connection String.

Key Vault allows encryption of Keys, which provides an access to control the lifecycle of encryption Keys and provides single place access of the Application Keys.

Customers who use the Cloud for deploying their Applications are more concerned about the security. Azure key vault is a better option for them rather than putting Keys and Secrets in the Applications configuration file.

Azure Key Vault Life Cycle

In the figure, given below, you can see the developer has both Cloud app and Key Vault access.

Developer can authorize Cloud Application by configuring it with Key Vault URL to access Azure Key Vault at run time.



We can also assign a dedicated person to manage Key Vault. The developer only has an access to Cloud Application. The developer can use Key Vault URL, given by Key Vault manager to deploy the Application. Application can access Key Vault at the run time.



Now, we will see, how to create Key Vault, using Azure PowerShell.

Step 1. Open Azure PowerShell or Windows PowerShell ISE.



Step 2. Login to your Azure account.



You will get the screen, shown below, after successful login.



Step 3. Create a resource group.



Step 4. Create a Key Vault. Vault name should be unique.



You can see new Key Vault has been created with the name ‘AshishKeyVault’. You will need the Vault URL to access Key Vault through the Application.

Step 5. Set Access Policies.

1. Provide an access to other users.
   
   
   
   Permission to Keys has been changed to encrypt.
   
   
   You can grant an access to other personnel with the same command.
   
   
2. Provide access to Cloud Applications.
   
   First, you need to be registered in Azure Active directory from azure portal.