Azure Secrets Engine

Dynamic secrets are a core feature in Vault. A class of dynamic secrets is on-demand, revocable, time-limited access credentials for cloud providers. For example, the Dynamic Secrets getting started tutorial demonstrated the AWS secrets engine to dynamically generate AWS credentials (access key ID and secret access key).

»Challenge

To consume Azure services (e.g. Azure Kubernetes service), the client must have valid Azure credentials. Azure uses service principal to authenticate its users. An Azure service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. So each new application adds operational overhead as more service principals are required.

»Solution

Automate the process by integrating your applications with Vault's Azure secrets engine. The applications ask Vault for Azure credential with a time-to-live (TTL) enforcing its validity so that the credentials are automatically revoked when they are no longer used.

»Benefits

Each app instance can request unique, short-lived credentials. Unique credentials ensures isolated, auditable access and enable revocation of a single client. While short-lived reduces the time frame in which they are valid.

»Personas

The end-to-end scenario described in this tutorial involves two personas:

• admin with privileged permissions to configure secrets engines
• apps read the secrets from Vault

»Prerequisites

This tutorial assumes the following:

• You have a Microsoft Azure account
• Vault installed

»Policy requirements

Each persona requires a different set of capabilities. These are expressed in policies. If you are not familiar with policies, complete the policies tutorial.

# Mount secrets engines
path "sys/mounts/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Configure the azure secrets engine and create roles
path "azure/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Write ACL policies
path "sys/policies/acl/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Manage tokens for verification
path "auth/token/create" {
  capabilities = [ "create", "read", "update", "delete", "list", "sudo" ]
}

# Mount secrets engines
path "sys/mounts/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Configure the azure secrets engine and create roles
path "azure/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Write ACL policies
path "sys/policies/acl/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Manage tokens for verification
path "auth/token/create" {
  capabilities = [ "create", "read", "update", "delete", "list", "sudo" ]
}

path "azure/creds/edu-app" {
  capabilities = [ "read" ]
}

path "azure/creds/edu-app" {
  capabilities = [ "read" ]
}

»Lab setup

»Create an Azure service principal and resource group

(Persona: admin)

To delegate the credential generation task to Vault, you need to give Vault privileged Azure credentials to perform the task. The following demonstrates the creation of a service principal.

1. Launch the Microsoft Azure Portal and sign in.

2. Select Azure Active Directory and select Properties.

3. Copy the Tenant ID.

4. In a terminal, set the variable TENANT_ID to the Tenant ID.

   $ export TENANT_ID=<Tenant ID>
   

   $ export TENANT_ID=<Tenant ID>
   

   Copy

5. From the side navigation, select App registrations.

6. Select New registrations.

7. Enter a desired name in the Name field (e.g. vault-education).

8. Click Register.

9. Copy the Application (client) ID.

10. In a terminal, set the variable CLIENT_ID to the Application (client) ID.

    $ export CLIENT_ID=<Client ID>
    

    $ export CLIENT_ID=<Client ID>
    

    Copy

11. From the side navigation, select Certificate & secrets.

12. Under the Client secrets, click New client secret.

13. Enter a description in the Description field.

14. Click Add.

15. Copy the client secret value.

16. In a terminal, set the variable CLIENT_SECRET to the client secret value.

    $ export CLIENT_SECRET=<Client secret>
    

    $ export CLIENT_SECRET=<Client secret>
    

    Copy

17. From the side navigation, click API permissions.

18. Under Configured permissions, click Add a permission.

    The Azure Secrets Engine documentation lists the Azure permissions need to be assigned.

19. Click Microsoft Graph.

20. Click Delegated permissions.

21. Add the following permissions.

    Permission Name	Type
    Application.Read.All	Delegated
    Application.ReadWrite.All	Delegated
    Directory.AccessAsUser.All	Delegated
    Directory.Read.All	Delegated
    Directory.ReadWrite.All	Delegated
    Group.Read.All	Delegated
    Group.ReadWrite.All	Delegated
    GroupMember.Read.All	Delegated
    GroupMember.ReadWrite.All	Delegated

22. Click Add a permission again, click Microsoft Graph, and then select Application permissions.

23. Add the following permissions.

    Permission Name	Type
    Application.Read.All	Application
    Application.ReadWrite.All	Application
    Application.ReadWrite.OwnedBy	Application
    Directory.Read.All	Application
    Directory.ReadWrite.All	Application
    Group.Read.All	Application
    Group.ReadWrite.All	Application
    GroupMember.Read.All	Application
    GroupMember.ReadWrite.All	Application

24. Click Add permissions.

25. Click Grant admin consent for azure to grant the permissions.

26. Click Yes to confirm consent.

27. Navigate to the Subscriptions blade.

28. Click the name of your subscription.

29. Copy the Subscription ID.

30. In a terminal, set the variable SUBSCRIPTION_ID to the Subscription ID.

    $ export SUBSCRIPTION_ID=<Subscription ID>
    

    $ export SUBSCRIPTION_ID=<Subscription ID>
    

    Copy

31. From the side navigation, click Access control (IAM).

32. Click Add > Add a role assignment.

33. Select Owner and click Next.

34. Click Select members.

35. Enter your application name or application id in the Select field.

36. Click the application when it is displayed which will add the application to the Selected members list.

37. Click Select.

38. Click Review + assign, and then Review + assign gain.

The application is created with the correct permissions and you have these identifiers and credentials:

• Tenant ID
• Client ID
• Client Secret
• Subscription ID

»Resource Group

The secrets engine generates credentials within an Azure resource group.

1. Navigate to the Resource groups blade.

2. Click Create.

3. Choose the subscription from the Subscription select field.

4. Enter vault-education in the Resource group field.

5. Click Review + create.

   The view changes to display the review page.

6. Click Create.

The resource group vault-education is created.

»Configure Vault

With the necessary resources configured in Azure, you can configure the Azure secrets engine to dynamically generate Azure service principals.

»Enable the Azure secrets engine

$ vault secrets enable azure

$ vault secrets enable azure

»Configure the Azure secrets engine

(Persona: admin)

The Azure secrets engine requires the credentials you generated in the create an Azure service principal and resource group step to communicate with Azure and generate service principals.

Verify that your Azure subscription ID, client ID, client ID, and tenant ID are stored as environment variables.

$ echo $SUBSCRIPTION_ID; echo $CLIENT_ID; echo $CLIENT_SECRET; echo $TENANT_ID

$ echo $SUBSCRIPTION_ID; echo $CLIENT_ID; echo $CLIENT_SECRET; echo $TENANT_ID

If any of those variables are missing their value, refer to the previous step and set them before proceeding.

$ vault write azure/config \
     subscription_id=$SUBSCRIPTION_ID  \
     client_id=$CLIENT_ID \
     client_secret=$CLIENT_SECRET \
     tenant_id=$TENANT_ID \
     use_microsoft_graph_api=true

$ vault write azure/config \
     subscription_id=$SUBSCRIPTION_ID  \
     client_id=$CLIENT_ID \
     client_secret=$CLIENT_SECRET \
     tenant_id=$TENANT_ID \
     use_microsoft_graph_api=true

»Create a role

(Persona: admin)

A Vault role lets you configure either an existing service principal or a set of Azure roles.

$ vault write azure/roles/edu-app ttl=1h azure_roles=-<<EOF
    [
      {
        "role_name": "Contributor",
        "scope": "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/vault-education"
      }
    ]
EOF

$ vault write azure/roles/edu-app ttl=1h azure_roles=-<<EOF
    [
      {
        "role_name": "Contributor",
        "scope": "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/vault-education"
      }
    ]
EOF

The role named edu-app is created.

»Request Azure credentials

The role generates credentials with a time-to-live (TTL) of 1 hour and max TTL of 24 hours.

The results display the credentials, its TTL, and the lease ID. The credentials for this application (service principal) in the Azure Portal searching by its client_id.

»Manage leases

(Persona: admin)

The credentials are managed by the lease ID and remain valid for the lease duration (TTL) or until revoked. Once revoked the credentials are no longer valid.

$ vault list sys/leases/lookup/azure/creds/edu-app

$ vault list sys/leases/lookup/azure/creds/edu-app

Keys
----
o2F4EA3hU8Fpjgc39XyQpjtU
fRFeCtlMnoPqelTrjf5j5kGA

Keys
----
o2F4EA3hU8Fpjgc39XyQpjtU
fRFeCtlMnoPqelTrjf5j5kGA

$ LEASE_ID=$(vault list -format=json sys/leases/lookup/azure/creds/edu-app | jq -r ".[0]")

$ LEASE_ID=$(vault list -format=json sys/leases/lookup/azure/creds/edu-app | jq -r ".[0]")

$ vault lease renew azure/creds/edu-app/$LEASE_ID

$ vault lease renew azure/creds/edu-app/$LEASE_ID

Key                Value
---                -----
lease_id           azure/creds/edu-app/EA2uTB98qAPR2BRSaasnmnja
lease_duration     1h
lease_renewable    true

Key                Value
---                -----
lease_id           azure/creds/edu-app/EA2uTB98qAPR2BRSaasnmnja
lease_duration     1h
lease_renewable    true

»Clean up

The Azure credentials created to configure the secrets engine should be deleted if they are no longer required.

1. Launch the Microsoft Azure Portal and sign in.

2. Navigate to Azure Active Directory.

3. From the side navigation, select App registrations.

4. Click the vault-education application (or whatever the name you set for the application).

5. From the application overview, click delete.

6. Select Yes to delete the application. The application is deleted.

7. Navigate to Resource groups.

8. Click the vault-education resource group.

9. From the resource group overview, click Delete resource group.

10. Enter vault-education in the TYPE THE RESOURCE GROUP NAME: field.

11. Click Delete. The resource group is deleted.

»Stop the Vault server

»Help and Reference

You enabled and configured the Azure secrets engine. Learn more by exploring the documentation or API documentation.

Azure Key Vault can auto-unseal the Vault server. Learn this through this Azure Key Vault Auto-unseal & Dynamic Secrets with HashiCorp Vault demonstration.