»Azure Key Vault

The Key Management secrets engine supports lifecycle management of keys in named Azure Key Vault instances. This is accomplished by configuring a KMS provider resource with the azurekeyvault provider and other provider-specific parameter values.

The following sections describe how to properly configure the secrets engine to enable the functionality.

»Authentication

The Key Management secrets engine must be configured with credentials that have sufficient permissions to manage keys in an Azure Key Vault instance. The authentication parameters are described in the credentials section of the API documentation. The authentication parameters will be set with the following order of precedence:

If the client ID or secret are not provided and Vault is running on an Azure VM, Vault will attempt to use MSI to access Azure. Note that when MSI is used, the tenant ID must still be explicitly provided by the configuration or environment variable.

An Azure Key Vault access policy determines whether a given service principal, namely an application or user group, can perform certain operations on a Key Vault instance. The service principal associated with the provided credentials must have an access policy on the Key Vault instance with the following minimum key permissions:

create
delete
get
import
update

»Configuration

The following is an example of how to configure the KMS provider resource using the Vault CLI:

$ vault write keymgmt/kms/example-kms \
    provider="azurekeyvault" \
    key_collection="keyvault-name" \
    credentials=client_id="a0454cd1-e28e-405e-bc50-7477fa8a00b7" \
    credentials=client_secret="eR%HizuCVEpAKgeaUEx" \
    credentials=tenant_id="cd4bf224-d114-4f96-9bbc-b8f45751c43f"

Refer to the Azure Key Vault API documentation for a detailed description of individual configuration parameters.

»Key Transfer Specification

Keys are securely transferred from the secrets engine to Azure key vault instances in accordance with the Azure Bring Your Own Key specification.