azure-key-vault

Name: azure-key-vault
Author: vinayaklatthe

54installs34forks

How to install azure-key-vault?

vinayaklatthe/microsoft-security-skills/azure-key-vault

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-key-vault

Installs into the current project.

Summary

Guidance for Azure Key Vault — securely storing and managing secrets, keys, and certificates with RBAC, network isolation, managed identity access, soft delete / purge protection, and rotation. Covers when to use standard Key Vault vs Managed HSM (FIPS 140-3 Level 3), one-vault-p

Files · 1

View on GitHub

SKILL.md

1	# Azure Key Vault
2
3	Azure Key Vault centrally and securely stores secrets, keys, and certificates, providing
4	RBAC-based access control, network isolation, logging, and lifecycle automation - so
5	applications never embed credentials and crypto material has a managed lifecycle.
6
7	## When to use
8	Managing application secrets, encryption keys (including customer-managed keys / BYOK), and
9	TLS certificates. Use this skill to pick standard vs Managed HSM, design access, and plan
10	rotation.
11
12	Do not use this skill for CA design (`pki-design`), Entra app credentials only
13	(`entra-id`), or PaaS networking topology (`azure-network-security-design`).
14
15	## Pick the vault type and access model
16
17	\| Requirement \| Choice \| Notes \|
18	\|---\|---\|---\|
19	\| Application secrets, TLS certs, software-protected keys \| Standard Key Vault \| Default; FIPS 140-2 Level 2 \|
20	\| Single-tenant HSM with FIPS 140-3 Level 3 keys (CMK, root CA) \| Managed HSM \| Regulated workloads \|
21	\| Per-app, per-environment isolation \| One vault per app per environment \| Limits blast radius \|
22	\| App reading secrets at runtime \| Managed identity + RBAC (Key Vault Secrets User) \| No secrets in code \|
23	\| App Service / Functions secret in config \| Key Vault references in app settings \| No code change \|
24	\| Customer-managed key for Storage / SQL \| Key in Key Vault (or HSM) + identity grant \| Rotate independently \|
25
26	> Rule of thumb: one vault per app per environment (dev / test / prod). Don't share a
27	> vault across apps - a compromise of one app's identity reads all the others' secrets. Use
28	> Managed HSM only when the regulator or CMK boundary requires FIPS 140-3 Level 3.
29
30	## Approach
31
32	1. Use Azure RBAC for the data plane — Switch the vault to RBAC permission model (not
33	legacy access policies). Assign least-privilege roles (`Key Vault Secrets User`,
34	`Key Vault Crypto User`) to managed identities, not user accounts.
35	*Verify: vault `enableRbacAuthorization = true`; no users with `Key Vault Administrator`
36	in prod.*
37
38	2. App access via managed identity + Key Vault references — App authenticates with a
39	system-assigned or user-assigned managed identity, fetches secrets at runtime.
40	For App Service / Functions, use Key Vault references in app settings -
41	`@Microsoft.KeyVault(SecretUri=...)` - no SDK code change.
42	*Verify: source code contains no plaintext secrets; managed identity has only the
43	secrets role on the target vault.*
44
45	3. Enable soft delete + purge protection — Soft delete is on by default; **turn on
46	purge protection** to make accidental or malicious key deletion non-recoverable for
47	90 days. Required for CMK and most compliance scenarios.
48	Verify: `softDeleteRetentionInDays >= 7`; `enablePurgeProtection = true`.
49
50	4. Restrict network access — For sensitive vaults, disable public network access and
51	use private endpoint in the workload VNet. Firewall the rest with service tags or
52	selected networks.
53	*Verify: `publicNetworkAccess = Disabled`; private endpoint resolves; public IP test
54	from internet = blocked.*
55
56	5. One vault per app per environment — Per-app blast radius. Cross-app reads are then a
57	role grant, audited. Don't lump secrets into a shared vault.
58
59	6. Automate rotation + monitor expiry — Set expiry on secrets / certs; use **rotation
60	policies** for certificate auto-renewal from issuer; for secrets, use Event Grid → Logic
61	App / Function to rotate at the source and update the secret.
62	*Verify: no secret in production has a NULL expiry; alerts fire 60 days before any cert
63	or secret expires.*
64
65	7. Monitor + Defender — Enable diagnostic logs to Log Analytics; turn on **Defender for
66	Key Vault** for anomalous access detection.
67
68	## Guardrails
69	- One vault per app per environment limits blast radius and simplifies access control.
70	Shared vaults are an over-permission anti-pattern.
71	- **Purge protection is irreversible once on - required for CMK and many compliance
72	scenarios.** Turn it on knowingly.
73	- **Never store secrets in source / config; use managed identity + Key Vau

People who liked this also viewed

6 picks

Type

azure-key-vault

54installs34forks

View on GitHub

How to install azure-key-vault?

vinayaklatthe/microsoft-security-skills/azure-key-vault

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-key-vault

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Key Vault
2
3	Azure Key Vault centrally and securely stores secrets, keys, and certificates, providing
4	RBAC-based access control, network isolation, logging, and lifecycle automation - so
5	applications never embed credentials and crypto material has a managed lifecycle.
6
7	## When to use
8	Managing application secrets, encryption keys (including customer-managed keys / BYOK), and
9	TLS certificates. Use this skill to pick standard vs Managed HSM, design access, and plan
10	rotation.
11
12	Do not use this skill for CA design (`pki-design`), Entra app credentials only
13	(`entra-id`), or PaaS networking topology (`azure-network-security-design`).
14
15	## Pick the vault type and access model
16
17	\| Requirement \| Choice \| Notes \|
18	\|---\|---\|---\|
19	\| Application secrets, TLS certs, software-protected keys \| Standard Key Vault \| Default; FIPS 140-2 Level 2 \|
20	\| Single-tenant HSM with FIPS 140-3 Level 3 keys (CMK, root CA) \| Managed HSM \| Regulated workloads \|
21	\| Per-app, per-environment isolation \| One vault per app per environment \| Limits blast radius \|
22	\| App reading secrets at runtime \| Managed identity + RBAC (Key Vault Secrets User) \| No secrets in code \|
23	\| App Service / Functions secret in config \| Key Vault references in app settings \| No code change \|
24	\| Customer-managed key for Storage / SQL \| Key in Key Vault (or HSM) + identity grant \| Rotate independently \|
25
26	> Rule of thumb: one vault per app per environment (dev / test / prod). Don't share a
27	> vault across apps - a compromise of one app's identity reads all the others' secrets. Use
28	> Managed HSM only when the regulator or CMK boundary requires FIPS 140-3 Level 3.
29
30	## Approach
31
32	1. Use Azure RBAC for the data plane — Switch the vault to RBAC permission model (not
33	legacy access policies). Assign least-privilege roles (`Key Vault Secrets User`,
34	`Key Vault Crypto User`) to managed identities, not user accounts.
35	*Verify: vault `enableRbacAuthorization = true`; no users with `Key Vault Administrator`
36	in prod.*
37
38	2. App access via managed identity + Key Vault references — App authenticates with a
39	system-assigned or user-assigned managed identity, fetches secrets at runtime.
40	For App Service / Functions, use Key Vault references in app settings -
41	`@Microsoft.KeyVault(SecretUri=...)` - no SDK code change.
42	*Verify: source code contains no plaintext secrets; managed identity has only the
43	secrets role on the target vault.*
44
45	3. Enable soft delete + purge protection — Soft delete is on by default; **turn on
46	purge protection** to make accidental or malicious key deletion non-recoverable for
47	90 days. Required for CMK and most compliance scenarios.
48	Verify: `softDeleteRetentionInDays >= 7`; `enablePurgeProtection = true`.
49
50	4. Restrict network access — For sensitive vaults, disable public network access and
51	use private endpoint in the workload VNet. Firewall the rest with service tags or
52	selected networks.
53	*Verify: `publicNetworkAccess = Disabled`; private endpoint resolves; public IP test
54	from internet = blocked.*
55
56	5. One vault per app per environment — Per-app blast radius. Cross-app reads are then a
57	role grant, audited. Don't lump secrets into a shared vault.
58
59	6. Automate rotation + monitor expiry — Set expiry on secrets / certs; use **rotation
60	policies** for certificate auto-renewal from issuer; for secrets, use Event Grid → Logic
61	App / Function to rotate at the source and update the secret.
62	*Verify: no secret in production has a NULL expiry; alerts fire 60 days before any cert
63	or secret expires.*
64
65	7. Monitor + Defender — Enable diagnostic logs to Log Analytics; turn on **Defender for
66	Key Vault** for anomalous access detection.
67
68	## Guardrails
69	- One vault per app per environment limits blast radius and simplifies access control.
70	Shared vaults are an over-permission anti-pattern.
71	- **Purge protection is irreversible once on - required for CMK and many compliance
72	scenarios.** Turn it on knowingly.
73	- **Never store secrets in source / config; use managed identity + Key Vau

People who liked this also viewed

6 picks

Type