You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The best way to authenticate to Azure services is by using a [managed identity](../general/authentication.md), but there are some scenarios where that isn't an option. In those cases, access keys or passwords are used. You should rotate access keys and passwords frequently.
17
17
18
+
This tutorial shows how to automate the periodic rotation of secrets for databases and services that use two sets of authentication credentials. Specifically, this tutorial shows how to rotate Azure Storage account keys stored in Azure Key Vault as secrets. You'll use a function triggered by Azure Event Grid notification.
19
+
20
+
> [!NOTE]
21
+
> For Storage account services, using Microsoft Entra ID to authorize requests is recommended. For more information, see [Authorize access to blobs using Microsoft Entra ID](../../storage/blobs/authorize-access-azure-active-directory.md). There are services that require storage account connection strings with access keys. For that scenario, we recommend this solution.
22
+
23
+
Here's the rotation solution described in this tutorial:
24
+
25
+
26
+
27
+
In this solution, Azure Key Vault stores storage account individual access keys as versions of the same secret, alternating between the primary and secondary key in subsequent versions. When one access key is stored in the latest version of the secret, the alternate key is regenerated and added to Key Vault as the new latest version of the secret. The solution provides the application's entire rotation cycle to refresh to the newest regenerated key.
28
+
29
+
1. Thirty days before the expiration date of a secret, Key Vault publishes the near expiry event to Event Grid.
30
+
1. Event Grid checks the event subscriptions and uses HTTP POST to call the function app endpoint that's subscribed to the event.
31
+
1. The function app identifies the alternate key (not the latest one) and calls the storage account to regenerate it.
32
+
1. The function app adds the new regenerated key to Azure Key Vault as the new version of the secret.
33
+
34
+
## Prerequisites
35
+
* An Azure subscription. [Create one for free.](https://azure.microsoft.com/free/?WT.mc_id=A261C142F)
36
+
* Azure [Cloud Shell](https://shell.azure.com/). This tutorial is using portal Cloud Shell with PowerShell env
37
+
* Azure Key Vault.
38
+
* Two Azure storage accounts.
39
+
40
+
> [!NOTE]
41
+
> Rotation of shared storage account key revokes account level shared access signature (SAS) generated based on that key. After storage account key rotation, you must regenerate account-level SAS tokens to avoid disruptions to applications.
42
+
43
+
You can use this deployment link if you don't have an existing key vault and existing storage accounts:
44
+
45
+
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FKeyVault-Rotation-StorageAccountKey-PowerShell%2Fmaster%2FARM-Templates%2FInitial-Setup%2Fazuredeploy.json)
46
+
47
+
1. Under **Resource group**, select **Create new**. Name the group **vault rotation** and then select **OK**.
48
+
1. Select **Review + create**.
49
+
1. Select **Create**.
50
+
51
+
52
+
53
+
You'll now have a key vault and two storage accounts. You can verify this setup in the Azure CLI or Azure PowerShell by running this command:
Next, you'll create a function app with a system-managed identity, in addition to other required components. You'll also deploy the rotation function for the storage account keys.
78
+
79
+
The function app rotation function requires the following components and configuration:
80
+
- An Azure App Service plan
81
+
- A storage account to manage function app triggers
82
+
- An access policy to access secrets in Key Vault
83
+
- The Storage Account Key Operator Service role assigned to the function app so it can access storage account access keys
84
+
- A key rotation function with an event trigger and an HTTP trigger (on-demand rotation)
85
+
- An Event Grid event subscription for the **SecretNearExpiry** event
1. In the **Resource group** list, select **vaultrotation**.
92
+
1. In the **Storage Account RG** box, enter the name of the resource group in which your storage account is located. Keep the default value **[resourceGroup().name]** if your storage account is already located in the same resource group where you'll deploy the key rotation function.
93
+
1. In the **Storage Account Name** box, enter the name of the storage account that contains the access keys to rotate. Keep the default value **[concat(resourceGroup().name, 'storage')]** if you use storage account created in [Prerequisites](#prerequisites).
94
+
1. In the **Key Vault RG** box, enter the name of resource group in which your key vault is located. Keep the default value **[resourceGroup().name]** if your key vault already exists in the same resource group where you'll deploy the key rotation function.
95
+
1. In the **Key Vault Name** box, enter the name of the key vault. Keep the default value **[concat(resourceGroup().name, '-kv')]** if you use key vault created in [Prerequisites](#prerequisites).
96
+
1. In the **App Service Plan Type** box, select hosting plan. **Premium Plan** is needed only when your key vault is behind firewall.
97
+
1. In the **Function App Name** box, enter the name of the function app.
98
+
1. In the **Secret Name** box, enter the name of the secret where you'll store access keys.
99
+
1. In the **Repo URL** box, enter the GitHub location of the function code. In this tutorial, you can use **https://github.com/Azure-Samples/KeyVault-Rotation-StorageAccountKey-PowerShell.git** .
100
+
1. Select **Review + create**.
101
+
1. Select **Create**.
102
+
103
+
104
+
105
+
After you complete the preceding steps, you'll have a storage account, a server farm, a function app, and Application Insights. When the deployment is complete, you'll see this page:
106
+
107
+
108
+
> [!NOTE]
109
+
> If you encounter a failure, you can select **Redeploy** to finish the deployment of the components.
110
+
111
+
You can find deployment templates and code for the rotation function in [Azure Samples](https://github.com/Azure-Samples/KeyVault-Rotation-StorageAccountKey-PowerShell).
112
+
113
+
### Add the storage account access keys to Key Vault secrets
114
+
115
+
First, set your access policy to grant **manage secrets** permissions to your user principal:
116
+
# [Azure CLI](#tab/azure-cli)
117
+
```azurecli
118
+
az keyvault set-policy --upn <email-address-of-user> --name vaultrotation-kv --secret-permissions set delete get list
You can now create a new secret with a storage account access key as its value. You'll also need the storage account resource ID, secret validity period, and key ID to add to the secret so the rotation function can regenerate the key in the storage account.
128
+
129
+
Determine the storage account resource ID. You can find this value in the `id` property.
Add secret to key vault with validity period for 60 days, storage account resource ID, and for demonstration purpose to trigger rotation immediately set expiration date to tomorrow. Run this command, using your retrieved values for `key1Value` and `storageAccountResourceId`:
This secret will trigger `SecretNearExpiry` event within several minutes. This event will in turn trigger the function to rotate the secret with expiration set to 60 days. In that configuration, 'SecretNearExpiry' event would be triggered every 30 days (30 days before expiry) and rotation function will alternate rotation between key1 and key2.
176
+
177
+
You can verify that access keys have regenerated by retrieving the storage account key and the Key Vault secret and compare them.
178
+
179
+
Use this command to get the secret information:
180
+
# [Azure CLI](#tab/azure-cli)
181
+
```azurecli
182
+
az keyvault secret show --vault-name vaultrotation-kv --name storageKey
Notice that `CredentialId` is updated to the alternate `keyName` and that `value` is regenerated:
192
+
193
+
194
+
195
+
Retrieve the access keys to compare the values:
196
+
# [Azure CLI](#tab/azure-cli)
197
+
```azurecli
198
+
az storage account keys list -n vaultrotationstorage
Notice that `value` of the key is same as secret in key vault:
208
+
209
+
210
+
211
+
## Use existing rotation function for multiple storage accounts
212
+
213
+
You can reuse the same function app to rotate keys for multiple storage accounts.
214
+
215
+
To add storage account keys to an existing function for rotation, you need:
216
+
- The Storage Account Key Operator Service role assigned to function app so it can access storage account access keys.
217
+
- An Event Grid event subscription for the **SecretNearExpiry** event.
1. In the **Resource group** list, select **vaultrotation**.
224
+
1. In the **Storage Account RG** box, enter the name of the resource group in which your storage account is located. Keep the default value **[resourceGroup().name]** if your storage account is already located in the same resource group where you'll deploy the key rotation function.
225
+
1. In the **Storage Account Name** box, enter the name of the storage account that contains the access keys to rotate.
226
+
1. In the **Key Vault RG** box, enter the name of resource group in which your key vault is located. Keep the default value **[resourceGroup().name]** if your key vault already exists in the same resource group where you'll deploy the key rotation function.
227
+
1. In the **Key Vault Name** box, enter the name of the key vault.
228
+
1. In the **Function App Name** box, enter the name of the function app.
229
+
1. In the **Secret Name** box, enter the name of the secret where you'll store access keys.
230
+
1. Select **Review + create**.
231
+
1. Select **Create**.
232
+
233
+
234
+
235
+
### Add storage account access key to Key Vault secrets
236
+
237
+
Determine the storage account resource ID. You can find this value in the `id` property.
Add secret to key vault with validity period for 60 days, storage account resource ID, and for demonstration purpose to trigger rotation immediately set expiration date to tomorrow. Run this command, using your retrieved values for `key2Value` and `storageAccountResourceId`:
Notice that `CredentialId` is updated to the alternate `keyName` and that `value` is regenerated:
295
+
296
+
297
+
298
+
Retrieve the access keys to compare the values:
299
+
# [Azure CLI](#tab/azure-cli)
300
+
```azurecli
301
+
az storage account keys list -n vaultrotationstorage
Notice that `value` of the key is same as secret in key vault:
311
+
312
+
313
+
314
+
## Disable rotation for secret
315
+
316
+
You can disable rotation of a secret simply by deleting the Event Grid subscription for that secret. Use the Azure PowerShell [Remove-AzEventGridSubscription](/powershell/module/az.eventgrid/remove-azeventgridsubscription) cmdlet or Azure CLI [az event grid event--subscription delete](/cli/azure/eventgrid/event-subscription?#az-eventgrid-event-subscription-delete) command.
317
+
318
+
18
319
## Key Vault rotation functions for two sets of credentials
19
320
20
321
Rotation functions template for two sets of credentials and several ready to use functions:
0 commit comments