Using Key Vault keys – Building Application Security

In the following example, we will create a storage account and then replace the default Microsoft-managed key with a customer-managed key, which will be stored in our key vault. We will start by creating the storage account via PowerShell:

1. First, we need to log in to our Azure account:
   Connect-AzAccount
2. If necessary, select the right subscription:
   Select-AzSubscription -SubscriptionId “-–––*”
3. Create a resource group and key vault:
   $resourceGroup = “cs-managedstorage-resourcegroup”
   $location = “eastus”
   New-AzResourceGroup -Name $resourceGroup -Location $location
   New-AzStorageAccount -ResourceGroupName $resourceGroup -Name csmanagedstorage101 -Location $location -SkuName Standard_LRS -Kind StorageV2

This will create a basic storage account in your subscription. Next, we will use the portal to update the encryption key:

1. Navigate to the Azure portal at https://portal.azure.com.
2. In the top search bar, search for and select Storage Accounts.
3. Click on the storage account you created in Step 3.
4. On the left-hand menu, click Encryption.
5. Change Microsoft-managed Keys to Customer-managed Keys.
6. By Encryption key choose Select from the key vault.
7. Click Select a key vault and key.
8. Select your subscription.
9. Select your key vault from the list.
10. Next to Key, click Create new.
11. Enter the following details:
    a) Options: Generate.
    b) Name: MyManagedStorageKey.
    c) Key Type: RSA.
    d) RSA Key Size: 2048.
    e) Set activation date?: leave unticked.
    f) Set expiration date?: leave unticked.
    g) Enabled?: Yes.
12. Click Create.
13. Click Select.
14. Click Save.

The screen will refresh and show the updated configuration – note as well that automated key rotation is enabled, meaning that Azure will automatically generate new keys for you and rotate them.

Using customer-managed keys on services such as storage accounts and SQL databases can sometimes require highly sensitive data.

Using Key Vault certificates

SSL certificates digitally bind cryptographic keys to an organization. They are often used in websites to provide secure HTTPS communications or to encrypt services.

Azure Key Vault provides an easy store to help manage and maintain your certificates. Precisely, it can do the following:

• Create certificates through a certificate creation process. Both self-signed and Certificate Authority-generated certificates can be created.
• Import existing certificates for management.
• Automatically renew certificates with selected issuers.

Therefore, certificates can be stored in a key vault and then accessed either manually through the portal or via programmatic means. For example, they can be referenced as part of an ARM deployment template to automatically install the certificate within a DevOps pipeline.

When we created the key vault, one of the steps involved in creating an access policy defined what actions you can access. We chose the default to give your account full access to all certificates, keys, and secrets.