Azure Key Vault is a platform-as-a-service key management solution for securely storing secrets, keys, and certificates used by Azure applications. It supports tightly managed access to this sensitive data, helping protect high-value organizational information. section 5.2 section 5.0
Secure a vault on two planes. The control plane manages the vault resource itself, including creation, deletion, and access-policy updates. The data plane manages the stored secrets, keys, and certificates. Authorization is needed for both planes; the ability to send a request does not itself grant access to vault data. section 5.2
Use the Key Vault firewall as a network layer alongside authorization:
- Restrict requests to specified VNets and subnets, such as a subnet containing virtual machines. section 5.2.3
- Allow a specific IPv4 address or CIDR range, such as an office network. section 5.2.3
- Allow selected trusted Microsoft services to bypass the firewall when required. section 5.2.3
- Turn on the configured rules by setting the default action to Deny. section 5.2.3
Restrict a vault to a VM subnet
First enable the Microsoft.KeyVault service endpoint on the target subnet. Then add that subnet as a Key Vault network rule. Finally, set the vault default action to Deny so the configured network rules are enforced. section 5.2.3
Listing 5.20 Enabling a service endpoint for Azure Key Vault on a VNet and subnet
az network vnet subnet update #1 --resource-group myResourceGroup #2 --vnet-name VNET #3 --name VMSubnet #4 --service-endpoints Microsoft.KeyVault #5 #1 The Azure CLI command to update the VNet subnet #2 The resource group name #3 The VNet name #4 The subnet name #5 The service endpoint you want to enable. To enable a service endpoint for the Azure Key Vault, the value needs to be Microsoft.KeyVault.
Use this Azure CLI command to enable the Microsoft.KeyVault service endpoint on a named VNet subnet before adding that subnet to a vault network rule. section 5.2.3
