I work at an organization that uses Azure and I need to set up an ETL process that will pull data from an API. Based on my research, everywhere on the internet says I should use Azure Key Vault to store the credentials rather than hard code them into Data Factory. I created a "secret" within a key vault that I created and configured the settings to only grant access to my windows login. However, my Azure subscription is part of an enterprise/multi-tenant subscription and I had a colleague (who has never used Azure before) screen-share with me, and he was able to access the credentials in the key vault I created simply by changing the access settings to "public" (he is able to see them in plain text after modifying the Network/Security settings).
Is this the expected behavior? I can see the benefit of allowing other user to modify the setting for a Key Vault (if I leave the company for example), but I'm not sure if there is a way around this, because I would assume if my co-worker (who is not admin-level) can see these credentials, than the IT department and/or higher-ranking people would be able to access these credentials quite easily...
Pretty much everything I find online says I should store credentials in Azure Key Vault, but if my whole organization has the ability to access the secrets, doesn't that seem like a major security issue?
Access Policy settings - Application is an Azure Data Factory instance which I created, User is my login/account
Networking settings - Private endpoint option is selected, but currently no private endpoints are on the access list. Co-worker was able to change this to "All networks", ultimately granting him access to view secrets.
Your colleague is probably having Owner or Contibutor role on subscription level. So he can change Key Vault settings and grant access to himself. This behaviour is by design.
It is explained in Microsoft article about Key Vault security:
If a user has Contributor permissions to a key vault management plane, the user can grant themselves access to the data plane by setting a Key Vault access policy. You should tightly control who has Contributor role access to your key vaults. Ensure that only authorized persons can access and manage your key vaults, keys, secrets, and certificates.
Related
I'm used to use GCP's secret manager. There, we can create a secret and give a specific READ permission for one specific service account.
I mean, let's say we create a secret ABC and a service account "getsecretaccount", I can give the read permission for this SA called getsecretaccount to access the ABC secret. This getsecretaccount will not have access to any other secret there.
Can I achieve this scenario in Azure Key Vault?
Thx!!
Authorization
Key vault offer two different Authorizations: older Vault access policy and newer Azure role-based access control
Vault access policy
BrunoLucasAzure already explained how this works. Personally I don't recommend using vault access policy unless you have some specific reason to use it:
resource re-deployment will reset existing authorization defined in key vault properties. ref: https://learn.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults?pivots=deployment-language-bicep#resource-format
passing [] to accessPolicies will clear access policy list
passing null or not using accessPolicies in template will generate error
of course you can read value of accessPoliciesbefore re-deployment and then re-use existing value when re-deploying resource. TBH that kind of hacks should not be required by resource.
For more information: https://docs.microsoft.com/azure/key-vault/general/assign-access-policy-portal
Azure role-based access control
Azure role-based access control based key vault authorization uses Azure RBAC assignments for key vault data layer access control.
There is multiple ready-made RBAC roles for key vault data layer:
Key Vault Administrator
Key Vault Secrets Officer
Key Vault Secrets User
Key Vault Reader
etc
Documentation only mentions thins Azure RBAC for key vault also provides the ability to have separate permissions on individual keys, secrets, and certificates
=> you can add RBAC roles into individual key/secret/certificate
Note that key/secret/certificate must be created before you can add RBAC to it.
For more information: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli
The answer
You can use both methods:
if you use older vault access policy, you need to create one key vault per service principal
if you use RBAC based access control, you can manage access control on individual secret level
if you have 1 azure vault with multiple secrets and you create an access policy for a user and select permission like "get" and/or "list", that user will be able to see all secrets under that vault. no option for separated permission per individual secret
I have a web API hosted on Windows server via IIS. I'm using Azure Key Vault to hide secrets. In order to give the application access to the vault, I am using a certificate installed on the server, which is also registered with the application in Azure.
The certs thumbprint, the tenant ID, and the application ID are all exposed in the configuration file of the web API. The apps registration is granted access via policy in the key vault.
The issue is that the integration assistant in Azure is alerting me that I should not have a certificate set up inside the registration, but with no explanation as to why (the documentation is greyed out for alert).
Can this alert be safely ignored? Or is there a better way to grant my application vault access?
Edit - snip of integration assistant:
Can this alert be safely ignored?
In your particular scenario, I would say yes. You can safely ignore this message.
Essentially you need a user to access the key vault. Considering your application is running locally, you would use the Service Principal (created as part of the app registration) as a user to access the key vault.
Or is there a better way to grant my application vault access?
In your particular scenario (when your application is running locally), AFAIK no.
If your application were running in Azure, you could have used Managed Identity. It could be either System-assigned Managed Identity or User-assigned Managed Identity. With managed identity, you need not require a secret/certificate based authentication.
I am not sure if your API is protected by Azure AD (i.e. a user must be authenticated/authorized before using the API), but if it does then one alternative would be to grant users of your API access to Key Vault. Requests to Key Vault will then be sent in context of that user. This however will increase the management complexity considerably as you have to manage access control for all your API users.
I'm trying to give a team the least privileged access to manage the keys, secrets and certs in their key vault, AND the ability to manage access policies.
Per these docs, the keys, secrets, and certs are handled in the data plane via access policies, and the ability to manage access policies is handled in the management plane via RBAC. So, we got the data access (keys, secrets, and certs) handled via an access policy. But we can't seem to get the permissions right to grant them the ability to manage access policies.
I created a custom role with the following permissions:
*/read
Microsoft.KeyVault/vaults/read
Microsoft.KeyVault/vaults/accessPolicies/write
Microsoft.Authorization/policyDefinitions/delete
Microsoft.Authorization/policyDefinitions/write
Microsoft.Authorization/policyDefinitions/read
Microsoft.Authorization/policyAssignments/delete
Microsoft.Authorization/policyAssignments/write
Microsoft.Authorization/policyAssignments/read
Even with these permissions, the users cannot add access policies. What are we doing wrong?
Also, I'm thinking that only the 'accessPolicies/write' permission (under Microsoft.Keyvault) is the only permission in the list that even relates to the ability to manage key vault access policies. Is that right? (are the policyDefinition and policyAssignment permissions irrelevant to this issue?)
Thanks!
are the policyDefinition and policyAssignment permissions irrelevant to this issue?
Yes, it is irrelevant to this issue.
Why are these Azure permissions not working?
To manage access policies, the Microsoft.KeyVault/vaults/accessPolicies/write action is not enough, assigen the custom role with this action to a user, then use the user account to test powershell command Set-AzKeyVaultAccessPolicy, obviously it needs Microsoft.KeyVault/vaults/write action.
Set-AzKeyVaultAccessPolicy -VaultName joytest123 -ResourceGroupName joyRG -ObjectId xxxxxx -PermissionsToKeys create,import,delete,list -BypassObjectIdValidation
So at least you need to use the Actions like below in your custom role.
"Actions": [
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/write",
]
And if you don't want the users to create new keyvaults, just need to assign the user with the custom role at the specific keyvault scope(select a keyvault -> Access control (IAM)), then he will not be able to do that.
Why would you not give the users keyvault administrator role to their key vault instead of creating a separate custom role? What access would they get if you assigned them that role on in the key vault that they wouldn't have otherwise?
Also, I would start with testing a built in role, like key vault administrator, then go backwards if you really wanted to remove specific permissions.
I've been doing some Key Vault testing and have noticed some odd behavior. I can create a secret and view the value just fine.
Before:
However, I've noticed when I create a tag on a secret, the secret is removed from the Show Secret Value area (shown below):
After:
I know the secret still exists as my UI is able to pull it and show it on a web page so it's not lost; just the option to view it is lost.
This feels like a bug unless I'm missing something?
Its correct, because I assume you haven't configure any permissions.
I test in my site and can reproduce your issue.
As Volodymyr said, to grant a user read access to Key Vault properties and tags, but not access to data (keys, secrets, or certificates), you need to grant management plane access with RBAC.
To grant access to a user to manage key vaults, you assign a predefined key vault Contributor role to the user. Then you could see the Show Secret Value area as before.
In my application I have to store very sensitive data of its users, such as various password to other 3rd part services (user fill a form where he provides us login and password to 3rd part service)
The goal of the application is to setup other complex system using powershell scripts generated from over 100 inputs. There is a requirement to save user work as draft, and that is why I need to encrypt sensitive fields somehow.
I read a lot about Azure Key Vault and whenever I read about secrets it seems they are described to hold app settings rather then users secrets, so i am not sure if this is right to place those data.
Is Azure Key Vault secrets suitable for that job?
Moreover i am able to peek those value in azure portal as in plain text, and I want to avoid that. I suppose that I could encrypt them first and store already encrypted values, but this may be over engineering.
It's not clear what you are describing as user secrets. If it's user credentials, then you need to federate login to an Identity Provider like Azure AD or Azure AD B2C. Key Vault is NOT an identity provider, but a secret store. If it's application secrets (think connection strings) then you should look at Key Vault (with Managed Service Identity).
Conversely, Application Settings (in App Service) are exposed in the Portal but are encrypted at rest. So if you're careful about who can access what within your subscription namespace, you should be just fine.