>> Secrets management services like HashiCorp Vault,
help us avoid secrets sprawl in our code in config files.
Yoko is here to show us how we can use Vault to
achieve tighter security using dynamic Azure credentials,
today on Azure Friday.
[MUSIC].
>> Hey everyone, Donovan Brown here with
another episode of Azure Friday.
I'm here with Yoko, and I'm going to be learning
all about Hashicorp Vault.
>> Yes.
>> Okay, so tell me what is that?
>> Yes. Hashicorp Vault is an open-source secret management tools.
We have a number of users actually
running Hashicorp Vault on Azure Cloud-
>> Okay.
>> And running on the VM.
So, as I know that
Azure Key Vault is there, so some people may be wondering why.
>> That's the question I was going to ask,
why are we doing this here?
>> Exactly. So that's why I'm here.
HashiCorp and Microsoft have been working
together to make the two technologies integrate
better and make our users
more secure their secrets in a cloud environment.
>> Okay. So, it seems like
an obvious question but why do I need them both?
All right, if I have Azure Key Vault,
why would I introduce HashiCorp Vault as well?
>> Right. Perfect questions.
So, if you are simply only purely worry
about keeping your managing your secrets like a credential,
like credit card information,
you don't have to have both.
You can just straight go to Azure Key Vault,
if that's you are comfortable with.
So, today I'm here to show how
Azure Key Vault can strength Hashicorp Vault,
and also where Hashicorp Vault can help Azure users.
>> Okay, got it. Let's see it.
>> Let's let's talk about it.
So, Hashicorp Vault is really designed
to be lightweight, easy to install.
All you have to do is to go to
the project website and download the binary-
>> Okay.
>> And put it on wherever you want to put it,
and unzip it, put it on a path, and ready to go.
>> All right, so I can run it locally on
my machine or I can run it in a VM in Azure?
>> Right.
>> Okay, got it.
>> So, if you want to just try around,
just download it on your laptop.
>> Okay.
>> You play with. As a matter of fact,
that's what I've done on my laptop.
>> Okay.
>> So, I already have binary downloaded,
and then unzipped and put it on my path.
>> Okay.
>> So, I'm going to start "Vault server".
The Vault server to start it,
the configuration file is as simple as this, just few lines.
>> Okay.
>> I'm going to go ahead and start the Vault server.
That's it just Vault server and pass the configuration file.
This is all you need to do.
>> Got it. So now it's accessible
on local hosts at that particular-
>> Exactly.
So, Hashicorp Vault being the secret management tool,
obviously, it will encrypt your secrets.
>> Yes.
>> Therefore, it has a encryption key.
>> Okay.
>> The encryption key is actually protected by master key,
and master key is not stored anywhere.
>> Got it.
>> So, when you first go start up the Vault server is says
"Sealed" that means it's started but it doesn't
know how to encrypt or decrypt your secret.
>> Okay.
>> The first step you have to do is to unseal the Vault server.
>> Okay.
>> I just started for the first time.
So the UI will tell you,
"Let's set up initial set of master keys."
I'm going to put it five and three.
What it means is that,
by default we use Shamir Secret
Sharing algorithm to split their master key into five shares.
In this case I put five.
>> Okay.
>> You can put a 10 or whatever you want.
>> Okay.
>> Then, threshold is three.
That means in order to generate the master key,
you need at least three out of the five shares.
So, that means I'm going to go ahead and
do that for demonstration purpose.
So it'll give you five keys.
That means you have to pick
maybe five people from your security organization that you trust.
Each one of them have to keep those secrets in a secure manner-
>> Okay.
>> As of their knowledge,
and then continue to unseal.
So, when you need to unseal the Vault server,
then you need three people all from
the security team to be ready
and enter their product keys to unseal it.
So, once Vault server goes into unseal mode,
it stays in unsealed until you
intentionally seal the Vault server for whatever reason,
or maybe stop and restart the server.
>> Got it.
>> So, if it just sounds like it's okay,
I mean that's how we try to
protect the environmental encryption key.
>> All right.
>> But, if you only have one cluster that's fine,
but if you have a production clusters and
maybe testing clusters or maybe you have a cluster
in Seattle and another cluster in New York,
and same team of people have to manage that clusters,
then it could be operational overhead.
>> It sounds like to, there's three of us have to be involved-
>> Yes.
>> To come in. But it's a secure thing.
I mean, some people could look at his overhead,
other people think that's awesome because
Donovan can't go in there by himself-
>> Exactly.
>> And do something he's not supposed to do.
He has to make sure that this is approved,
and then three people come in putting their portions,
and then that would unseal the Vault
or just unlock the Vault, what is that-
>> The terminology we use is unseal.
>> Okay.
>> Yeah. So, once unsealed,
then you're are ready to go, it's operational.
>> Okay, got it
>> So that could be operational overhead,
and also you are making those five people accountable-
>> Sure.
>> -for those keys. So, we do have actually auto-unseal features.
Which is basically, instead of having that using
that Shamir Secret Sharing algorithm,
you trust a cloud key.
In our case, we're going to talk about Azure Key Vault.
>> Key Vault. Got it.
>> Yes. Perfect. So, if you're going to use Azure Key Vault,
all you have to do is to provide
the Azure Key Vault information
into that server configuration file.
Just add this block of information, that's all you have to do.
>> Or when I started it,
that basic configuration when I started my vault.
>> All right.
>> Okay, got it, and this is just my server principle,
my tenant ID and sub ID, right?
>> Yes-
>> Okay.
>> And where to find. Yeah, exactly.
>> Sure.
>> So, I already have this Vault so it's
actually running on Azure Cloud VM.
>> Okay.
>> I have already configured with Azure Key Vault.
>> Got it. So, after I have my Azure Key Vault,
I created my Key Vault first in Azure.
>> Yes.
>> Then I take the keys that I generated when I unsealed it,
and I just put those as secrets inside a keyboard,
or do they get put there automatically for me when I unseal it?
>> So, yeah, it's part of
the initialization process and Vault would do that,
and generate it and put it.
>> Okay good. So, what all I did is I
configured before I ever started it.
Here's the Key Vault where I want you to
store the master key for me.
>> Yeah.
>> Then when I fired it up, it
generated it and stored it inside Key Vault.
So I've never seen those.
>> Right, because the configuration already tell it.
>> Got it [inaudible].
>> Basically. Yeah, exactly.
So, now this one is already set up for that.
So, I'm going to purposefully restart the Vault server.
>> Okay.
>> So, that will typically,
if you don't have an auto-unseal it will stop and restart.
So it goes into a sealed mode all over again.
>> Okay.
>> But because I already have auto-unseal setup.
So, if I do check the Vault status it says, "Sealed is false."
It's kind of double negative.
>> Sure.
>> But that means it's unsealed.
>> Understood.
>> So I'm going to. Let's look at-.
>> Sure no problem. So, at this point,
I could start using the secrets inside of
the HashiCorp Vault inside of my applications, right?
>> Yeah. Just look at the log and to show.
So, this is, it says,
"Vault server configuration", it knows to use Azure Key Vault.
>> Okay.
>> It's actually fetching the store unseal key.
>> Okay.
>> So, again we don't even see it.
>> Sure.
>> It's the direct conversation
between Vault server and Azure Key Vault.
>> Got it.
>> So, this is much better practice compared
to having five people accountable for keeping the secrets.
I mean, it's fine if you don't have anything else.
It's again secure, you don't have
a single person have that key to the kingdom.
>> All right.
>> So, this is how Azure Key Vault can
protect Hashicorp Vault even more secure manner,
especially, because Azure Key Vault is backed
by FIPS 140-2 Level 2 HSM.
>> Right.
>> It can be better than that.
>> Right.
>> So, that's the part Azure can complement Hashicorp Vault.
>> Okay.
>> On the Vault's side,
we talked about that.
If you have applications that needs to talk to Azure services,
then you have to have a credential to talk through that.
If I have to provide the server principle for
every application that needs to talk to
your Azure service, that's operational overhead.
If we are talking about dozens of applications,
then breezy you know
some applications might be sharing their credentials.
>> Right.
>> That's not what we want.
>> They also, service principles also expire,
which happened to me just the other day.
One of my release has just started failing and I'm panicking,
and I didn't realize until I went into
Azure and I can see my server principle had expired a week ago.
Right? So, and it's like that's a pain to deal with as well.
>> So, in Hashicorp Vault,
our users uses Hashicorp Vault
to generate these server principle dynamically.
>> Got you.
>> So, it's avoiding the manual process.
>> Right.
>> So, these are, I've already configured.
We have what we call Azure Secrets Engine.
So, that secret engine is the one that will,
basically, I delegate my work to Vault.
So, Vault would generate server principle on my behalf.
>> Got you.
>> So, I've already configured it with all the information
so that both server has enough credential to-
>> Sure.
>> Generate principle.
>> Yeah. Exactly.
>> So, when I do this,
what's doing underneath the cover is
Vault server is generating service principle.
So, let's say I'm using Vault CLI,
but underneath the cover is nothing by invoking Vault API.
>> Got you.
>> So, when the application request,
the applications can request credentials
from Hashicorp Vault instead of asking me.
>> Sure. All right-
>>> As a human to generate that.
>> Initially to avoid the situation
that I was just going to because
they'll recycle unnecessary so they only actually expire.
>> Yeah.
>> I don't have to worry about anyone even knowing the key or
the secret for that server principle
because it's been auto-generated.
>> Right, and so it's good
that you mentioned about the actual exploration.
You can sit at how ever you want it to be.
>> Got it.
>> Especially, when you know the applications are going
to talk to Azure Service,
it takes maybe 30 seconds to process that.
There is no reason to have credentials
sitting around for longer than you have to be.
So in this case,
you can make it even down to two minutes-
>> Got you.
>> -if you want to.
After that, time to leave,
Vault server will automatically revoke this credentials.
So in other words,
all the applications that needs to talk to Azure Service can
just request credential from HashiCorp Vault.
>> Got it. So if I have
a CI system that's going to deploy out into Azure,
instead of having a long-lived powerful service principle,
what I would do is have that CI system request one from you.
>> Yeah.
>> Say I want this to expire in half an hour.
It'll be able to deploy into Azure but,
it would then be revoked since there's no one else could use that.
>> Yeah.
>> In the next time I deploy it,
I would then go request another key. That would be a short-live.
>> Yeah.Yeah.
>> Okay, now I'm on the same page.
>> Also, we knew that leads to what we call the bed.
If it hasn't been finished within an hour,
you can renew it.
>> Okay. I'm going to assume that there has to be a way for
me to configure the R back for the,
like for example, I don't want my.
>> Yes, perfect.
>> Yeah. I don't want my servers principle to
be able to do everything. How do I control that?
>> Yeah. So what I did is you can actually use that role,
that Azure IAM role,
that you already defined.
>> Okay, got it.
>> Because this reader role that I created
is actually I'm using pointing to
the built-in reader role that's in Azure IAM.
>> Okay.
>> So you don't have to define it.
Access control can be fully controlled by the Azure side.
>> You got it, so I can go in,
set up the roles that I want and then
I'm telling you when you generate the service principle,
assign it to that role and that role only? Okay.
>> Perfect, yes. Exactly. Then also Vault can
provide what we call Break Glass Procedures.
If you feel like something was compromised in your system,
and you can actually do both lease
revoke and revoke all the credentials.
>> Okay.
>> If something happens in,
nowadays a lot of things happen in a cloud environment.
>> [inaudible] to GitHub or something like that. Well I've done.
>> So, yes. This is the demo that I have prepared to show.
Like Azure Key Vault can help
Vault server to protect the master key and make it secure,
and from Vault side,
can help Azure users easily to produce the credentials.
>> Awesome.
>> This has been really cool.
We're learning all about HashiCorp Vault,
here on Azure Friday.
[MUSIC]