Secrets Management Tools

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# Create a Key Vault with RBAC authorization
az keyvault create \
    --name "prod-myapp-kv" \
    --resource-group "rg-myapp" \
    --location "eastus" \
    --enable-rbac-authorization true \
    --enable-soft-delete true \
    --retention-days 90 \
    --enable-purge-protection true
 
# Assign built-in roles
 
# Key Vault Administrator - Full management
az role assignment create \
    --role "Key Vault Administrator" \
    --assignee "admin@company.com" \
    --scope "/subscriptions/{sub}/resourceGroups/rg-myapp/providers/Microsoft.KeyVault/vaults/prod-myapp-kv"
 
# Key Vault Secrets User - Read secrets only
az role assignment create \
    --role "Key Vault Secrets User" \
    --assignee "8a5c1234-5678-90ab-cdef-1234567890ab" \  # App's managed identity
    --scope "/subscriptions/{sub}/resourceGroups/rg-myapp/providers/Microsoft.KeyVault/vaults/prod-myapp-kv"
 
# Key Vault Crypto User - Cryptographic operations only
az role assignment create \
    --role "Key Vault Crypto User" \
    --assignee "service-principal-id" \
    --scope "/subscriptions/{sub}/resourceGroups/rg-myapp/providers/Microsoft.KeyVault/vaults/prod-myapp-kv/keys/encryption-key"
 
# Built-in Key Vault roles:
# - Key Vault Administrator: Full access to all objects
# - Key Vault Reader: Read vault metadata only
# - Key Vault Secrets Officer: Manage secrets (CRUD)
# - Key Vault Secrets User: Read secrets
# - Key Vault Crypto Officer: Manage keys (CRUD)
# - Key Vault Crypto User: Perform crypto operations
# - Key Vault Certificates Officer: Manage certificates (CRUD)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# Enable system-assigned managed identity on an App Service
az webapp identity assign \
    --name "mywebapp" \
    --resource-group "rg-myapp"
 
# Output includes the principal ID
# {
#   "principalId": "8a5c1234-5678-90ab-cdef-1234567890ab",
#   "tenantId": "12345678-1234-1234-1234-123456789012",
#   "type": "SystemAssigned"
# }
 
# Grant the managed identity access to Key Vault
az role assignment create \
    --role "Key Vault Secrets User" \
    --assignee "8a5c1234-5678-90ab-cdef-1234567890ab" \
    --scope "/subscriptions/{sub}/resourceGroups/rg-myapp/providers/Microsoft.KeyVault/vaults/prod-myapp-kv"
 
# Create a user-assigned managed identity (reusable across resources)
az identity create \
    --name "myapp-identity" \
    --resource-group "rg-myapp" \
    --location "eastus"
 
# Assign to multiple resources
az vm identity assign \
    --name "myvm" \
    --resource-group "rg-myapp" \
    --identities "/subscriptions/{sub}/resourceGroups/rg-myapp/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myapp-identity"
 
az aks update \
    --name "myaks" \
    --resource-group "rg-myapp" \
    --assign-identity "/subscriptions/{sub}/resourceGroups/rg-myapp/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myapp-identity"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

# Create a self-signed certificate
az keyvault certificate create \
    --vault-name "prod-myapp-kv" \
    --name "myapp-tls-cert" \
    --policy "$(az keyvault certificate get-default-policy)"
 
# Create certificate with custom policy
cat > cert-policy.json << 'EOF'
{
  "issuerParameters": {
    "name": "Self"
  },
  "keyProperties": {
    "exportable": true,
    "keySize": 4096,
    "keyType": "RSA",
    "reuseKey": false
  },
  "secretProperties": {
    "contentType": "application/x-pkcs12"
  },
  "x509CertificateProperties": {
    "keyUsage": ["digitalSignature", "keyEncipherment"],
    "subject": "CN=myapp.example.com",
    "subjectAlternativeNames": {
      "dnsNames": ["myapp.example.com", "api.myapp.example.com"]
    },
    "validityInMonths": 12
  },
  "lifetimeActions": [
    {
      "action": { "actionType": "AutoRenew" },
      "trigger": { "daysBeforeExpiry": 30 }
    }
  ]
}
EOF
 
az keyvault certificate create \
    --vault-name "prod-myapp-kv" \
    --name "myapp-tls-cert" \
    --policy @cert-policy.json
 
# Import an existing certificate
az keyvault certificate import \
    --vault-name "prod-myapp-kv" \
    --name "imported-cert" \
    --file "certificate.pfx" \
    --password "pfx-password"
 
# Configure integrated CA (DigiCert example)
az keyvault certificate issuer create \
    --vault-name "prod-myapp-kv" \
    --issuer-name "DigiCertCA" \
    --provider-name "DigiCert" \
    --account-id "DigiCert-Account-ID" \
    --password "DigiCert-API-Key"
 
# Create certificate from integrated CA
az keyvault certificate create \
    --vault-name "prod-myapp-kv" \
    --name "public-cert" \
    --policy "$(cat ca-cert-policy.json)"  # Policy with issuer set to DigiCertCA

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// App Service configuration - appsettings linked to Key Vault
{
  "properties": {
    "siteConfig": {
      "appSettings": [
        {
          "name": "DatabaseConnectionString",
          "value": "@Microsoft.KeyVault(VaultName=prod-myapp-kv;SecretName=db-connection-string)"
        },
        {
          "name": "ApiKey",
          "value": "@Microsoft.KeyVault(SecretUri=https://prod-myapp-kv.vault.azure.net/secrets/api-key/)"
        },
        {
          "name": "ApiKeyWithVersion",
          "value": "@Microsoft.KeyVault(SecretUri=https://prod-myapp-kv.vault.azure.net/secrets/api-key/abc123version)"
        }
      ]
    }
  }
}
 
// App Service must have:
// 1. System-assigned managed identity enabled
// 2. Key Vault Secrets User role on the vault
// 3. Key Vault firewall allowing App Service access (or private endpoint)
 
// Azure CLI setup:
// az webapp config appsettings set --name mywebapp --resource-group rg-myapp \
//   --settings "DatabaseConnectionString=@Microsoft.KeyVault(VaultName=prod-myapp-kv;SecretName=db-connection-string)"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

# Enable soft delete and purge protection (required for production)
az keyvault update \
    --name "prod-myapp-kv" \
    --enable-soft-delete true \
    --retention-days 90 \
    --enable-purge-protection true
 
# Backup individual secrets (encrypted blob)
az keyvault secret backup \
    --vault-name "prod-myapp-kv" \
    --name "database-password" \
    --file "database-password.backup"
 
# Backup a key
az keyvault key backup \
    --vault-name "prod-myapp-kv" \
    --name "encryption-key" \
    --file "encryption-key.backup"
 
# Backup a certificate
az keyvault certificate backup \
    --vault-name "prod-myapp-kv" \
    --name "tls-cert" \
    --file "tls-cert.backup"
 
# Restore to same or different vault (same tenant only!)
az keyvault secret restore \
    --vault-name "recovery-vault" \
    --file "database-password.backup"
 
# Recover soft-deleted vault
az keyvault recover --name "deleted-vault" --location "eastus"
 
# Recover soft-deleted secret
az keyvault secret recover \
    --vault-name "prod-myapp-kv" \
    --name "accidentally-deleted-secret"
 
# List deleted vaults and secrets
az keyvault list-deleted
az keyvault secret list-deleted --vault-name "prod-myapp-kv"
 
# Purge (permanently delete) - only if purge protection not enabled
az keyvault secret purge --vault-name "prod-myapp-kv" --name "old-secret"