It's time to talk about
"Managing Identities, Keys, and Secrets".
In this lesson, we are going to explore
the basics of Key Vault.
In addition, we're going to jump in
and see it live in the portal.
So let's get started by talking about what Key Vault is.
Key Vault is just a place that allows us to securely store
and access tokens, passwords, certificates, and API keys.
It provides us a way that we can centrally store
all of that information.
Now, that centralization is important
because it provides us better management
and better security of the environment.
And, before we move on, let's talk about what a secret is.
A secret's just anything that you want to control access to.
So a password might be a secret, right?
The third thing about Key Vault is it allows us to monitor
access. So we can set up auditing
and we can see exactly who's using keys,
which is very important in controlling our environment.
So now, let's go ahead and talk about
Key Vault with an example.
So let's say we have a database analyst,
and she needs to access a SQL Database.
And it doesn't have to be a SQL Database,
it could be an Azure Blob Storage or something else.
And in our case, in the portal,
I'm actually going to show you a storage account.
But for this case, let's just say it's a SQL Database.
Now to start off with,
she's going to have to be authenticated
through Azure Active Directory via RBAC.
We've talked about RBAC and identity access management,
but that's the first step to her getting access.
Once she's been authenticated,
we need to decrypt the data that's in the database.
To do that, we need a key.
Now, we access Azure Key Vault to decrypt the data,
and we do so using a data encryption key
or this DEK that you see here.
And there's 2 different types of keys.
There's a data encryption key, and that data encryption key
just encrypts or decrypts the data
that we're trying to access.
And then we have a key encryption key.
Now the key encryption key is very special,
and it never leaves the Key Vault.
The key encryption key basically gives us a way
to encrypt or decrypt that data encryption key.
So we have our master key, and, from that, we can make
additional keys that we can use to unlock the data.
The good news is if we ever need to control access
to those data encryption keys, we can just remove
that key encryption key, and without that,
the data encryption keys are rendered useless,
because we can't decrypt the data.
Now, in addition to that, we can have separation of duties.
So we have our database analyst,
and she can access the data.
And let's say that we have our security guy here,
and he can access the Azure Key Vault.
He doesn't have access to the SQL Database,
because he's not authenticated
through Azure Active Directory.
Likewise, our database analyst can't access
the Azure Key Vault, she can only access the database.
So we have some separation there, that's really good.
In addition to that, we can also have an auditor,
and this auditor can use Azure Monitor,
and he can actually audit event logs in Azure Key Vault,
so we can see how those data encryption keys are being used,
and we can see how those key encryption keys
are being used by the security team.
So we have multiple layers of individual people
that only have access to their specific portion.
So that separation gives us defense in depth
and gives us additional security.
All right, so let's go ahead and jump into the portal
and see what this looks like.
So here we are in Key Vault,
and you can see on the left, at a high level,
I have my Keys, I have my Secrets, my Certificates,
and I can create keys or secrets as I want.
So let's just say that I want to go in here
and generate a key. And we'll call this
dp203sample.
And I can set all kinds of different features here,
but for now, let's just go ahead and create a sample key.
So that quick, I have created a dp203sample key.
Now, that key is being stored in my Key Vault.
Now let's say that I jump over to my storage account,
and I go down to my Encryption setting.
You can see here that I can choose to either use
Microsoft-managed keys or I can use customer-managed keys.
Those are the keys that I'm creating.
And so let's say that I want to do that,
and I want to select a key from the Key Vault that I had.
So I can click on that. I can choose my Key Vault.
And now you can see, here is the key that we just created.
So with that, I can click on that, and now I have enabled
or I can enable a Key Vault key that I've created
rather than using the standard Microsoft-managed keys.
Now with that, let's go ahead and wrap up our lesson
with a few key points.
First, use the Key Vault. Don't hardcode passwords.
I've said this a couple of times.
The Key Vault is a fantastic way to store the information
of keys and certificates that we need.
It's also really helpful as your environment grows.
If you have just 1 SQL Database, yeah,
you can probably get away with just managing
through that SQL Database.
As it grows into a series of resources,
you're going to need to use something more,
and Key Vault's really helpful here,
because you can create that separation between security
and the people that are trying to access your data,
and even your data engineers. So very, very helpful.
In addition to that, hey, don't forget to set up auditing.
You should be periodically auditing your environment
to help keep your environment secure.
And so with that, we're actually ready
to wrap up this lesson.
Don't forget what Key Vault is.
Don't forget that it's a central place that stores
our keys, and secrets, and certificates.
With that, that's the end of this lesson.
I'll see you in the next.