Up:: Microsoft Azure Developer Associate AZ-204 2023

Azure Key Vault

Azure Key Vault

• 07:11:08 Azure Key Vault Introduction
  • helps you safeguard cryptographic keys and other secrets used by cloud apps and services
  • Focuses on three things
    • Certificate Management
      • Easily Provision, manage and deploy public and private SSL Certificates for use with Azure and internal connected resources
    • Key Management
      • Create and Control the encryption keys used to encrypt your data
    • Secrets Management
      • Store and tightly control access to tokens, passwords, certificates, API Keys, and other secrets
    • **Certificates contain key pair (key and secret) not to be confused with Key Management and Secret Management**
  • HSM and FIPS
    • Hardware Security Module - Piece of hardware designed to store encryption keys
    • Federal Information Processing Standard (FIPS) - US and Canadian government standard that specifies the security requirement for cryptographic modules that protect sensitive information
    • HSMs that are multi-tenant are FIPS 140-2 Level 2 Compliant
    • HSMs that are single-tenant are FIPS 140-2 Level 3 Compliant
  • Vault
    • stores secrets and keys that can be protected either by software or FIPS 140-2 Level 2 validated HSMs
    • Azure Key Vaults provide two types of containers
      • Vaults - supports software and HSM backed keys
      • HSM pools - only supports HSM backed keys
        • To activate your HSM, you need
          • provide a minimum of three RSA key-pairs (max 10)
          • specify the minimum number of keys required to decrypt the security domain (called a quorum)
      • You do not choose container on creation, you choose between Standard and Premium
        • If you choose Premium and create enough RSA key-pairs you will begin to use HSM pools.
  • Key Vault API
    • Azure Key Vault API used to programmatically manage Azure Key Vault resources, allowing operations such as
      • Create a key or secret
      • Import a key or secret
      • Revoke
      • Delete
      • Authorize user or apps to access its keys or secrets
      • Monitor and manage key usage
    • Supports three different types of authentication
      • Managed Identities - Identity manage by Azure AD (recommended as best practice)
      • Service Principal and Certificate - uses a certificate
      • Service Principal and Secret - user and secret key
  • Recovery Options
    • Soft Delete -
    • Mandatory retention period
    • Purge protection
  • Pricing
    • 07:18:26 Pricing
    • Standard
    • Premium
      • Allows for both software and HSM-protected keys
  • Keys
    • Three options
      • Generate - Azure will generate
      • Import - Import existing RSA key
      • Restore Backup - Restore a key from backup
    • For keys generated by Azure you can use either RSA or EC
      • RSA (Rivest-Shamir-Adleman) 2048, 3072, 4096
      • EC (Elliptic-curve Cryptography) - P-256, P-384, P-521, P-256K
    • Premium Vault
      • You have options for HSMs
    • Microsoft Managed Key (MMC) keys managed by Microsoft. Does not appear in you vault in most cases but are used by default for many Azure services.
    • Customer Managed Key (CMK) are keys you create in Azure Key Vault
      • You need to select a key from a vault for various services
    • Infrastructure encryption is sometimes an option
      • By default, Azure encrypts storage account data at rest. Infrastructure encryption adds a second layer of encryption to your storage account’s data.
  • Double Encryption
    • Storage accounts - option for Infrastructure Encryption - adds second layer of encryption to your Storage account data. Encrypted by default at rest
    • Azure Disks - Double Encryption - where two or more independent layers of encryption are enabled to protect against compromises of any one layer of encryption.
    • Two layered approach each for Data at Rest and In transit
      • Data-at-rest
        • Disk encryption using CMK (Customer Managed Keys)
        • Infrastructure Encryption using platform-managed keys
      • Data-in-transit
        • Transit encryption using Transport Layer Security (TLS) 1.2
        • Additional Layer of encryption provided at the infrastructure layer
  • Secrets
    • Azure Key Vault Secrets provides secure storage of generic secrets such as passwords and database connection strings
    • Key Vault APIs accept and return secret values as strings
    • Internally, Key Vault stores and manages secrets
      • as sequence of octets (8-bit bytes)
      • with a maximum size of 25k bytes each
    • Key Vault service doesn’t provide semantics for secrets
      • accepts the data, encrypts it, stores it, and returns a secret identifier (“id”)
    • For highly sensitive data, clients should consider additional layers of protection for data.
      • Encrypting data using a separate protection key prior to storage in Key Vault is one example
    • Key Vault also supports a contentType field for secrets
      • Client may specify the content type of a secret to assist in interpreting the secret data when it is retrieved
      • maximum length of this field is 255 characters
    • All secrets are encrypted
      • Key Vault encrypts secret at rest with hierarchy of encryption keys
        • all keys in that hierarchy are protected by modules that are FIPS 140-2 compliant
        • encryption leaf key is unique per vault
        • encryption root key of key hierarchy is unique to the security words
          • protection levels varies between regions
          • China user FIPS-140-2 Level 1, rest uses Level 2 or higher
    • Secret Attributes
      • exp - expiration time
      • nbf - not before (default is now)
      • enabled - whether data can be retrieved
      • also read only attributes for created and update
  • X509 Certificates
    • PKI - Public Key Infrastructure
    • x.509 certificate
      • standard defined by ITU (Inter)
    • What is a CA (Certificate Authority)
    • X509 Chain of Trust
      • CA can issue multiple certificates in the form of a tree structure
      • Root Certificate Authority
      • Intermediate Certificate Authority
      • End Entity Certificate
    • X509 Certificate Format
    • Certificate Extensions
      • PEM
    • Certificate Signing Requests
  • Certificates
    • Azure Key Vault allows you to import, generate and manage X.509 certificates
  • Composition of a Certificate with Azure Key Vault
  • Certificate Policy
• 07:44:01 Azure Key Vault - Keys Follow Along
• 07:47:49 Azure Key Vault - Backup and Restore Key
• 07:53:18 Azure Key Vault - Rotate Key
• 07:56:03 Secrets
• 08:11:18 Certificates

---

Additional Metadata

• Type:: note
• Origin:: Microsoft Azure Developer Associate AZ-204 2023
• Status:: #status/🌲
• Tags:: Azure