How secure is Azure Key Vault?
Azure Key Vault is designed to store (and protect) secrets such as API keys, passwords, cryptographic keys, connection strings, etc. It can store the following categories of data:
- Keys
- Certificates
- Secrets
The Secrets storage can store arbitrary plaintext values, so Key Vault could potentially be used as a means of centrally managing a collection of usernames and passwords that could be copied and pasted straight from the Azure Portal. Is this a safe method of password management, though? How secure is a Key Vault, really? Is it marginally more secure than storing API keys, client secrets and connection strings in a Web application’s configuration file?
The Microsoft documentation states that:
‘The Key Vault front end (data plane) is a multi-tenant server. This means that key vaults from different customers can share the same public IP address. In order to achieve isolation, each HTTP request is authenticated and authorized independently of other requests’. It would seem that all Key Vaults are on the same machine or VM, and there’s no physical or logical segregation.
Elsewhere, the documentation also states:
‘Azure Key Vault uses nCipher HSMs, which are Federal Information Processing Standards (FIPS) 140-2 Level 2 validated. You can use nCipher tools to move a key from your HSM to Azure Key Vault.’ That’s another way of saying that the Key Vault is ultimately a Hardware Security Module, manufactured by Entrust, rather than a typical server hardware, to store the secrets, and it has some method of restricting what can access its storage.
As for user access, there are two methods of restricting this:
- Azure role-based access control, which involves using Managed Identities and Azure Active Directory to determine whether an application or service is authorised to access the Key Vault.
- IP address: This is effectively a default-deny firewall that restricts access to users, applications and services from specific IP address ranges, even using the Azure Portal. This is useful if we want Key Vault to be accessible only to users on the corporate network, whether physically or via a VPN gateway. Access can also be allowed for named virtual networks.
So, it means that an attacker would require more than access to an authorised user’s AD account, which should be protected to some extent by 2FA. The attacker would require access to a machine or proxy server on the authorised network.
Of course, Key Vault is designed for authorised applications and services to read secrets from, and that means there’s an API for it. We can configure the security of an API connection to a Key Vault, by requiring that connection to be authenticated. Options include Azure AD authentication and Managed Identity. This would restrict API access to authorised applications and clients.