Hello there and thank you very much for joining us in
this new Azure Portal How To video. Today we learn how
to use Key Vault in the Azure portal. And we have Eric Winner
with us who’s going to show us how to do that. So, thank
you very much for joining us today, Eric.
Thanks, Leon. As you know, the Key Vault is that
Azure service you use to
store the secrets and certificates
for usage in your application. So, it’s super important that
you configure and tighten the access to that vault and to
the items within the vault. And so, today that’s the area
I’m going to focus on as I show you how to configure the
access to your Key Vault and the items within.
So, let’s go take a look.
That sounds great. Let’s go take a look.
Okay. So, here we are in the Azure portal and we’re
going to go ahead and take a look at the key Vault service,
which will show you the list of all the vaults that you’ve
created and which subscription they’re in. So, let’s go
ahead and create a new vault and I’ll show you that during
create how you set up the access and then once it’s
created, we’ll even go in and show you how to edit it. So,
creating a Key Vault’s super easy. You just put it in a
resource group, you give the Key Vault a name. And then
I’m going to show you during create on the next screen
how you set up the access. There’s some default access
that comes, like I can access it because I’m in there, but
there’s two modes of accessing a vault. One is through this
vault policy and that’s a
built-in facility for Key Vault for
managing the internals. Or you can also integrate with
Azure RBAC, the role based access within Azure, and use
the Azure system for managing the vault contents. In
addition to those two models, you can also configure
resource access, so you can either have virtual machines,
the resource manager deployment templates, or disk
encryption for volume
encryption access to the vault, and
then it can use the contents of the secrets in the vaults for
performing those operations. Here you can see as the
creator of the vault, I’ve got access, but let’s go ahead and
give Leon some access.
So, this LinkedIn create here allows me to choose from a
predefined template. I’m going to go ahead, I think, and
make Leon a secret manager. And you can see pretty
clearly here the set of permissions he’s going to end up
with. Then I move along to select who. And here, we’re
searching Active Directory and you can see we’re going to
pull up Leon and give him
some access to this vault as well
as a secrets manager. It’s also possible to do application
level grants. I’m not going to cover that, but with your
application identity, you can let your application connect to
the vault. And then you get a quick summary. And I’ve
created this record. This
table is laid out here to let you at
a glance see who has what access. You configure
networking and tags and
then jump to the end here just to
go ahead and get the summary and validation and we’ll
kick off this vault creation.
And this will just take a moment as this Key Vault creates
in the back end system.
And then I’m going to give you a look into some of the
updates we’ve made both on the home page as well as in
the menuing system for the Key Vault to help you keep the
Key Vault secure.
Okay, this Key Vault’s ready. So, now let’s jump into the
Key Vault. Here on the home page, again, we’re helping
you with the initial scenarios, one of which is controlling
access to the vault, and we’ve got the access
configuration, which looks a lot like you saw in the create
where I choose, do I want to use the Vault access policy,
or do I want to use the Azure role-based access? And
because this one is set for the Vault access, there’s a
handy button here which navigates me directly to that
same list of who has access to the secrets, keys, and
permissions inside this vault. And from here I can go
ahead and create and I get that same create experience
that I had when creating
the vault to edit here. And so, I
can go ahead and start out with key management and
maybe reduce, take away the create and delete and
update, and make someone just more of a reader of the
keys. Again, I can pick a person. Here we can go ahead
and choose Dan from our team and make him more of a
consumer of a key and go ahead and get to the end of
here and just as easily as we did during create when I’m
managing and I can add him. And, again, at a glance, this
table lets me see which
permissions each person has in the
column. There you can see it at a glance. I can see the
level of permissions. Again, I told you about these two
modes, but let’s go ahead and take a look at what the
access control settings are that are available. I can easily
see the role-based assignments. This right now is
controlling just the management of the vault itself. But I’ll
show you that we do ship
with a full set of built-in roles.
If I were to switch this vault to being managed using Azure
RBAC, I can then use these built-in roles that we ship to
easily give sets of permissions for the crypto officer or the
secrets officer. And then I’m using the built-in RBAC
system of Azure to manage both the vault itself as well as
access to the data plane operations around the keys and
secrets and certs within the vault.
And I should mention, like this is a pretty basic intro, I
think, for how it works. We do have some great
documentation out there.
Hopefully, we’ll post a link to the
documentation, so you can get some deeper knowledge
here of how to fully think about and configure access to
your Key Vaults.
Thank you very much, Eric. This was great. Please
try this out. Let us know what you think. Leave us a
comment. Also, we have more than 60 videos with similar
scenarios that you can try and learn about other parts of
Azure and if you want to try and you want to learn how
to use the platform. So, please try them out as well.
And thank you very much for watching. Look forward to
seeing you in the next video. Bye for now.