Hi, Welcome to my channel.
In this video I am goanna show you how to securely access a secret in an Azure Key Vault
from an Azure virtual machine.
Let's assume you are developing an application and want to deploy it to an Azure virtual
machine.
It's very common that the application needs to access a backend database, let's say it
is an SQL Server database, which requires your application to provide a connection string,
and the connection string will include your database username and password.
So we know that it is a bad idea to store the password in your application configuration
files locally.
A better solution is to store your password or connection string as a secret in an Azure
Key Vault.
Now the next question is that how can you access the securely stored connection string
from your application or your Azure virtual machine?
Do you need to provide another password?
Otherwise any people can access your stored password or connection string, use them to
connect to your database and access or modify your data.
So we will need to have another mechanism to securely access our secret stored in Azure
key vault, and this mechanism should not leverage password, otherwise it is goanna be a chicken
and egg problem.
Luckily, this is easy to achieve on Azure.
We can use a feature called Managed Identity to assign an azure resource an identity, in
this particular case, the Azure resource is your virtual machine.
This service was formerly known as Managed Service Identity (MSI).
The identity assigned to your virtual machine is very similar to an Azure user, you can
then grant permissions or roles to this identity as a normal Azure user.
And the application running inside the virtual machine can then acquire the role and use
it's assigned permission to access the relevant Azure resources.
In this case, the Azure resource is the secret stored in your Azure Key Vault.
OK, enough talking, let's jump to Azure portal see how to configure this.
So here I have already created a Key Vault, and in this key vault I have an secret called
"SQLConnectionString", and if I click this secret and select the current version, here
you can see the secret vault has been masked, you can click this "Show Secret Value" to
see the secret value.
And in this case my secret is an SQL Server connection string, and let's imaging that
we can use this connection string to access my SQL server instance running at somewhere.
And also I have an Azure virtual machine VM01, which is going to run the application that
needs to access my SQL server database by using the identity assigned to this virtual
machine.
By default, Azure virtual machines do not have nay identity assigned, so I am goanna
go to the "identity" setting under the settings section, and from here, I can assign this
virtual machine an identity.
As you can see from this page, we have two types of managed identities, system assigned
and user assigned.
The system assigned identity has an one to one relationship with the Azure resource that
it is assigned to.
each resource can only have one system assigned managed identity.
And the system assigned managed identity will also be deleted if the relevant resource is
deleted.
On the other hand, the user assigned managed identities are created as standalone Azure
resources and can exist independently from other Azure resources.
This type of managed identities have a many to many relationship with the Azure resources
they are assigned to.
That is to say, a singe resource can have multiple user assigned managed identities,
similarly, a single user assigned managed identity can be shared across multiples Azure
resources.
In this exercise, I will be using System assigned managed identity, So I am goanna change the
status from off to on, and save.
The portal reminds me that this vm will be registered with Azure AD, and once it is registered,
this vm can be granted permissions to access Azure resources.
That's exactly what I want, so I will click yes to register.
Now the VM is registered with Azure AD with an system assigned managed identity, let's
go back to the key vault, and under the settings section, if we click the Access policies blade,
on this page we can add access policies to assign permissions to VM01, So I am goanna
click "Add access policy" and because I want VM01to be able to retrieve the secret or the
connection string from this key vault, I will select "Secret Management" as the template,
which automatically selects all the secret management operations for the secret permissions.
Alternatively, you can choose individual operations from this list.
And as you can see from here, you can also use Azure Key Vault to manage your Keys and
Certificates, and you can select the operations for them from here as well.
So they are the permissions you want to assign with this access policy, another aspect of
the access policy is which principal you want to assign these permissions to, principal
is just another fancy name for identity, currently nothing has been selected, if we click the
link here "none selected", a new blade will pop up, from here we can search the VM by
typing VM01 in the search bar, and I am goanna select VM01 from the list then click Select
to add this VM to the access policy.
Now I have selected the permissions and the principal, let's click the "add" button to
create this access policy.
And don't forget to save.
At this point, the application running inside VM01 should be able to retrieve the secret
or connection string stored in our key vault.
To verify this, I have connected to this virtual machine via SSH, and on this Linux VM, I have
install PowerShell Core and Azure PowerShell module, so I can run powershell by typing
pwsh, and from the powershell prompt, I can run the Azure powershell command-lets.
To access the secret stored in our Azure key vault, firstly we will need to acquire the
system assigned identity by connecting to Azure with managed identity.
Here I used -identity as the parameter for the command Connect-AzAccount, this parameter
tells the command to connect to Azure using the identity assigned to this vm, instead
of asking for a credential.
As you can see here that I logged in to Azure with this MSI account, which is the short
name for Managed Service Identity, and I did not provide any credentials or passwords at
all.
Now we should be able to get the connection string from the key vault.
Let’s use the Azure PowerShell command Get-AzKeyVaultSecret to fetch the secret object and store it to
a variable.
The secretvaule property of this object is an encrypted secure string, so we will ConvertFrom-SecureString
to convert it to a plain text string.
And here we go, we have successfully retrieved the connection string stored in the key vault
from this virtual machine.
Alright, Thank you for your watching, if this video is useful, please give it a like, subscribe,
comment and share.
That's it, until next time, take care!