Pular para o conteúdo principal

Azure Key Vault key stores - Amplia

note

Azure Key Vault stores are compatible with all supported platforms

Azure Key Vault can be thought of as a cloud HSM. Keys are stored on FIPS 140-2 Level 2 validated HSMs for a relatively low cost of ~5 dollars per month per key. This service from Microsoft has enabled the employment of HSMs on projects which otherwise would not have the necessary budget.

tip

Lacuna Software's cloud-based Amplia instance (SaaS offering) stores all CA keys on Azure Key Vault, and we highly recommend it for instances installed both on the cloud or on local servers.

Procedure​

To configure an Azure Key Vault key store on Amplia, log in Azure portal and use the following settings:

Creating an application and authentication secret​

Create an application corresponding to your Amplia instance:

  1. In the option Microsoft Entra ID, go to App registrations and click New registration
  2. Enter a name for the application
  3. Leave the rest of the fields in the default options
  4. Click on Register

Once the application is created, take note of the Application (client) ID.

Generate a secret for application identification:

  1. In the application settings, click Certificates & secrets
  2. In Client secrets, click New client secret
  3. Fill in a description and choose an expiration
  4. Click Add
  5. Copy the displayed value in column Value (it will not be possible to recover this value later!)
warning

Client secrets always expire (the longest expiration available is 24 months). Before the secret expires, generate a new one and update the AppKey setting, otherwise Amplia will no longer be able to access the Key Vault. To avoid this, you can authenticate with a certificate instead (see the CertThumb setting below).

Creating the Key Vault​

Create the Key Vault (skip this part if you want to use an existing Key Vault):

  1. In the option Key vaults, click Create
  2. Fill in the data according to your infrastructure
  3. In the Pricing tier option, choose Premium to be able to generate keys stored in HSM
  4. On the Access configuration tab, keep the default Permission model, Azure role-based access control
  5. Click Review + create
  6. Click Create

Once the creation of the Key Vault is complete, click Go to resource. Then, take note of the Key Vault's Vault URI, shown on the Overview page (ex: https://my-key-vault.vault.azure.net/).

Granting permissions to the application​

How to grant permissions to the application depends on the Permission model of the Key Vault, shown on Settings > Access configuration. New Key Vaults use Azure role-based access control by default. Older Key Vaults may use Vault access policy instead.

If the Key Vault uses Azure role-based access control:

  1. In the Key Vault, click Access control (IAM), then Add > Add role assignment
  2. On the Role tab, select Key Vault Crypto Officer and click Next
  3. On the Members tab, choose User, group, or service principal and click Select members
  4. Select the created application and click Select
  5. Click Review + assign, then click Review + assign again to confirm
note

The Key Vault Crypto Officer role is required because Amplia creates keys on the Key Vault. The Key Vault Crypto User role does not allow creating keys.

If the Key Vault uses Vault access policy:

  1. In the Key Vault settings, click Access policies, then Create
  2. On the Permissions tab, without using a template, select only the following Key permissions: Get, List, Create, Verify and Sign. Then click Next
  3. On the Principal tab, select the created application and click Next
  4. Click Next until you reach the review step, then click Create

Amplia configuration​

Edit your JSON configuration file or your App Service settings and add a section with a name to the KeyStores section that identifies the Key Vault (see example below), and place the following settings in it:

  • Type: AzureKeyVault
  • Endpoint: Vault URI of the key vault (shown on the key vault's Overview page) -- e.g.: https://my-pki.vault.azure.net/
  • AppId: Application ID to be used to authenticate with Azure
  • AppKey: Application secret key to be used to authenticate with Azure (for additional security, omit this value and specify the CertThumb instead)
  • CertThumb: thumbprint of the certificate to be used to authenticate with Azure (hex-encoded, as provided by the Azure Portal)
  • TenantId (optional, Amplia 5.0 or later): ID of the Microsoft Entra tenant to authenticate with. If omitted, the tenant is taken from the Key Vault's authentication challenge
  • UseManagedIdentity (Amplia 5.0 or later): set to true to authenticate with the managed identity of the host where Amplia runs (for instance, the managed identity of its App Service) instead of an application secret or certificate. In this case, leave AppKey and CertThumb blank, and grant the permissions described above to the managed identity instead of an application
  • UseHsm: by default, HSM-protected keys are created. To use "software" keys, set this value to false

Example (.ini or .conf configuration file):

[KeyStores:MyKeyVault]
Type=AzureKeyVault
Endpoint=https://xxx.vault.azure.net/
AppId=00000000-0000-0000-0000-000000000000
AppKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

Example (environment variables):

KeyStores__MyKeyVault__Type=AzureKeyVault
KeyStores__MyKeyVault__Endpoint=https://xxx.vault.azure.net/
KeyStores__MyKeyVault__AppId=00000000-0000-0000-0000-000000000000
KeyStores__MyKeyVault__AppKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

Example (.json configuration file):

"KeyStores": {
	...,
	"MyKeyVault": {
		"Type": "AzureKeyVault",
		"Endpoint": "https://xxx.vault.azure.net/",
		"AppId": "00000000-0000-0000-0000-000000000000",
		"AppKey": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
	},
	...
}

See also​

View as Markdown