Configure Azure Key Vault connection¶

The following guide illustrates connecting TLS Protect Cloud with Azure Key Vault (AKV).

Enable TLS Protect Cloud to provision new certificates in Azure Key Vault (AKV) for use with Azure services. Also, now users have the capability to import existing certificates into keystores. This enables tasks such as rotating, renewing expiring certificates, auto-renewal, changing certificate authorities (CAs), and more.

This guide walks you through the integration process.

Overview¶

The following diagram illustrates the high-level steps for integrating TLS Protect Cloud with Azure Key Vault (AKV). In the subsequent sections, we dive into each of these steps, providing you with a guided walkthrough.

Step 1: Create an Azure App registration (Service Principal)¶

1. Log in to the Azure Portal.
2. In the left panel, select Microsoft Entra ID and then App registrations.
3. Select the New Registration button in the top left corner.
4. In the Register an application panel, enter the following values:
   • Name - Enter a name that carries significance and can be readily linked to this specific cloud provider.
   • Supported account types - Choose the appropriate supported account types.
   • Redirect URL - Leave this blank or enter a redirect URI if needed.

5. Select Register.

   Important

   You will be presented with your app registration details. Make sure to copy and save the Application (Client) ID and Azure (Tenant) ID for later use.

6. Select the Add a certificate or secret, and then New client secret. Enter a description and click Add. You will be presented with your Secret ID only once, make sure to copy and save it for later use.

Step 2: Create Application access in Azure¶

In this step we grant permissions on Key Vault resources for the app (Service Principal) you just registered.

There are 3 ways to add these permissions:

1. Add built-in Azure RBAC role(s) to appropriate resources (e.g., a Resource Group or a Key Vault).
   • This option is the quickest, but built-in roles are not as granular.
   • Use this option if ease of implementation is your priority. We select the minimum number of built-in roles to allow access by TLS Protect Cloud.
2. Add a custom Azure RBAC role to appropriate resources (e.g., a Resource Group or a Subscription).
   • This option requires extra steps, but custom roles are sufficiently granular only to give minimum required access.
   • Use this option if most granular and minimal access is your priority and you do not mind adding a custom role to Resource Groups or Subscriptions.
3. Add Azure Access Policy configuration to appropriate Key Vault resources.
   • This option is semi-granular, meaning that the access policy is granular, but a single "reader" built-in Azure RBAC role is also required.
   • Use this option only if you prefer to use Azure Access Policy. This option does not have advantages over a custom RBAC role but has some disadvantages (such as configuring each Key Vault).

Granting Permissions with Azure Role-Based Access Control (RBAC) Permissions Model¶

Using Built-In Role(s)¶

1. Select applicable Key Vault (or Resource Group if managing Key Vaults via a Resource Group).
2. Select Access control (IAM).
3. Select + Add and then Add role assignment.
4. Select Job function roles unless already selected.
5. In the search bar enter Key Vault Certificates Officer, this will produce a list, highlight Key Vault Certificates Officer and select Next.
6. Click + Select members, this will open a panel to your right. Enter the app name you registered in Step 1 and select that app.
7. Select Review and assign.

Repeat for each Key Vault (or Resource Group) you wish to configure for access by TLS Protect Cloud. Your app (registered in Step 1) should have the following role on applicable Key Vaults:

• Key Vault Certificates Officer

Using Custom Role¶

Create Custom Role¶

1. Select the applicable Subscription (or Resource Group if managing Key Vaults via a Resource Group) that contains the Key Vaults you wish to give access to.
2. Select Access control (IAM).
3. Select + Add and then Add custom role.
4. Select the JSON tab and then click the Edit button.
5. Give your role a (unique) name and (optional) description by filling in the appropriate JSON fields (roleName and description).
6. For the permissions element, replace it with the following:

   "permissions": [
       {
           "actions": [
               "Microsoft.KeyVault/vaults/read",
               "Microsoft.KeyVault/vaults/secrets/read"
           ],
           "notActions": [],
           "dataActions": [
               "Microsoft.KeyVault/vaults/certificates/read",
               "Microsoft.KeyVault/vaults/certificates/update/action",
               "Microsoft.KeyVault/vaults/certificates/create/action",
               "Microsoft.KeyVault/vaults/certificates/import/action"
           ],
           "notDataActions": []
       }
   ]
   

7. Click the Save button.
8. Select Review + Create, and then select Create.

You'll have to repeat the above for each Subscription or Resource Group containing Key Vaults you wish to give access to.

Assign Custom Role¶

1. Select the applicable Key Vault (or Resource Group if managing Key Vaults via a Resource Group).
2. Select Access control (IAM).
3. Select + Add and then Add role assignment.
4. Select Job function roles unless already selected.
5. In the search bar, enter your custom role name. This will produce a list, highlight your custom role, and select Next.
6. Click + Select members. This will open a panel to your right. Enter the app name you registered in Step 1 and select that app.
7. Select Review and assign.

Repeat this for each Key Vault (or Resource Group) you wish to configure for access by TLS Protect Cloud. Your app (registered in Step 1) should have your custom role on applicable Key Vaults.

Granting Permissions with Vault Access Policy Permissions Model¶

First, we need to grant one Azure RBAC permission:

1. Select applicable Key Vault (or Resource Group if managing Key Vaults via a Resource Group).
2. Select Access control (IAM).
3. Select + Add and then Add role assignment.
4. Select Job function roles unless already selected.
5. In the search bar enter Key Vault Reader, this will produce a list, highlight Key Vault Reader and select Next.
6. Click + Select members, this will open a panel to your right. Enter the app name you registered in step 1 and select that app.
7. Select Review and assign.

Repeat for each Key Vault (or Resource Group) you wish to configure for access by TLS Protect Cloud. Your app (registered in Step 1) should have the following role on applicable Key Vaults:

• Key Vault Reader

Now we can grant access policy permissions:

These permissions must be granted on each Key Vault you wish to manage. They cannot be granted via a Resource Group.

1. Select applicable Key Vault.
2. Select Access policies.
3. Select + Create.
4. Under Secret permissions, select Get.
5. Under Certificate permissions, select Get, List, Update, Create, Import.
6. Select Next.
7. For principal, enter the app name you registered in Step 1 and select that app.
8. Select Next, then select Next again.
9. Select Create.

Repeat for each Key Vault you wish to configure for access by TLS Protect Cloud.

Step 3: Create a Cloud Provider¶

1. Sign in to Venafi Control Plane.
2. Click Integrations > Cloud Providers.
3. Click New and select Azure.
4. Enter a Name for the new cloud provider. This name will help TLS Protect Cloud users to identify this cloud provider.
5. Select an Owning Team. If you need to create a new team see, create a new team.

6. Click Continue.

   Note

   • Owning Team - The Owning Team is responsible for the administration, management, and control of a designated cloud provider, with the authority to update, modify, and delete cloud provider resources.
   • Authorized Team - The Authorize Team is granted permission to use specific resources of a cloud provider. Although team members can perform tasks like creating a keystore, their permissions may be limited regarding broader modifications to the provider's configuration. Unlike the Owning Team, users may not have the authority to update and delete Cloud Providers.

7. Enter your Application (client) ID, Directory (tenant) ID, and Client secret obtained from Azure in the above steps.

   Info

   • Azure Application (client) ID - is an Active Directory Application Id. The client Id is the unique identifier of an application created in Active Directory. You can have many applications in an Active Directory and each application will have a different access levels.
   • Azure (tenant) ID - is the unique identifier of the Azure Active Directory instance. One subscription can have multiple tenants. Using this Tenant Id you register and manage your apps.
   • Azure Client secret - is a credential that is used to authenticate and authorize a client application when it interacts with Azure services.

8. Click Save. At this point, your new provider details will be displayed in the right pane.

Step 4: Validate the connection¶

In this step we will validate the connection between TLS Protect Cloud and Azure.

1. Click Integrations > Cloud Providers.

2. Find the new cloud provider we created in Step 1. Click the more options button to the right and select Test Access.

   Note

   You will notice a yellow icon next to your cloud provider that indicates it has yet to be validated. This will go away once you test access and have a successful connection.

If you still have the yellow icon next to your cloud provider, this means you were not able to successfully validate your connection. Go back and check your settings in the above steps.

Step 5: Add a Cloud Keystore¶

1. Sign in to Venafi Control Plane.
2. Click Installations > Cloud Keystores.
3. Click New and select Azure.
4. Enter a Name for the new cloud keystore.
5. Select an Owning Team. If you need to create a new team, see create a new team.

6. Select an Authorized Team.

   Note

   • Owning Team - The Owning Team is responsible for the administration, management, and control of a designated cloud provider, with the authority to update, modify, and delete cloud provider resources.
   • Authorized Team - The Authorize Team is granted permission to use specific resources of a cloud provider. Although team members can perform tasks like creating a keystore, their permissions may be limited regarding broader modifications to the provider's configuration. Unlike the Owning Team, users may not have the authority to update and delete Cloud Providers.

7. Select an Azure Cloud Provider.

8. Select a Subscription Name.
9. Select an Azure Key Vault Name.
10. (Optional) To begin discovery once the keystore is created, an option to discover certificates on your keystore, select the toggle switches to turn on "Start discovery immediately" and "Include expired certificates". After creating the keystore, refer to Set up AKV Discovery Schedule to create your schedule.
11. Click Save. At this point you should see your saved new cloud keystore in the Cloud Keystore list.
12. (Optional) If you didn't start discovery when creating the keystore in the above step, click the Discover Now button. You will notice a message in the top right of the pane indicating "Discovery Status: Running". Your results will begin to populate in the same pane.

Step 6: Provision a certificate¶

At this point you should now have the ability to provision certificates.

1. Click the button to the right of the new cloud keystore you just created and select Provision.

   Tip

   Here you also have the option to delete certificates if needed.

2. From the dropdown, search for the certificate you want, select it, and click Provision. This creates a new certificate (new installation on the keystore).

3. (Optional) Here, you also can re-provision, replace, or delete a certificate. These options modify an existing machine installation.

   • Select your Cloud Keystore, and a details panel will appear on the right.
   • Click on the button to the right of your certificate.
   • Choose the appropriate action: Re-provision, Replace, or Delete, and proceed through the user interface steps until the process is complete.

   Info

   • Re-provision - This action re-provisions your current certificate.
   • Replace - Choose this option to substitute your current certificate with a different one.
   • Delete - This action removes the selected certificate from the table.

   Note

   If using Google Cloud Platform, go to your Google service account, under Certificate Manager, and select Certificates. Click the Refresh button. You should now see your certificate in the list with an active status.

At this point you have successfully connected TLS Protect Cloud to your cloud provider and successfully provisioned a certificate.

Set up AKV Discovery Schedule¶

1. In the TLS Protect Cloud toolbar, click Installations and select Cloud Keystores from the drop-down menu.
2. Select the Cloud Keystore name that you want to perform a discovery on.
3. From the pane that opens on the right of the screen, select Discovery configuration. Select the toggle switches to turn on "Enable scheduled discovery" and "Include expired certificates".
4. Under Repeat every, select your desired Daily, Weekly, or Advanced schedule. Then, choose your desired time.
5. Click Save.