Harden key vault

Avatar
Nerdio Product Support

Key vaults allow for secure storage and access of keys, secrets, and certificates. Nerdio Manager stores sensitive values in its key vault, including the SQL connection string, and its SQL connectivity depends on the key vault. Hardening the key vault protects those values in two complementary ways:

  • Network hardening restricts which networks can reach the key vault. By default, the key vault is accessible from any internet location. Limiting access to your own virtual network, and optionally to a private endpoint, reduces the key vault's exposure.

  • Access hardening controls which identities can use the key vault, and what they can do with its keys, secrets, and certificates. Using Azure role-based access control (Azure RBAC) instead of the legacy access policy model gives you tighter, centrally managed control over who can grant and use that access.

The two work together: network hardening limits where connections can come from, and access hardening limits what each identity can do.

Network hardening for key vault

By default, the key vault is accessible from any internet location. You can restrict access to the key vault by configuring firewall rules or enabling a private endpoint, so that only traffic from your virtual network can reach it.

To harden network access to the key vault, complete the following steps:

Prerequisites

Before you start hardening the key vault, ensure the following prerequisites are met:

  • The App Service plan must be on a tier that supports VNet integration. For more details, see Upgrade the Azure App Service.

  • A virtual network (VNet) that can be used to connect the App Service and the storage account must be configured. This virtual network also needs outbound access for Nerdio Manager to communicate with the Nerdio licensing servers via HTTPS (TCP/443). The licensing server URL is https://nwp-web-app.azurewebsites.net/.

Step 1: Enable VNet integration for Nerdio Manager’s App Service

First, configure Virtual Network (VNet) integration for the Nerdio Manager's App Service.

To enable VNet integration for the App Service:

  1. In the Azure portal, navigate to App Services.

  2. Select the App Service.

    Note

    It typically has a name in the following format: nmw-app-xxxxxxxxx.

  3. In the left menu, navigate to Settings > Networking.

  4. Under Outbound traffic configuration, in Virtual network integration, select Not configured.

  5. In Virtual Network Integration, select Add virtual network integration.

  6. In the right pane that opens, add the virtual network you want to use:

    • Subscription: Select the subscription.

    • Virtual Network: Select the virtual network.

    • Subnet: Select the subnet.

    Note

    • VNet integration requires a subnet delegated specifically for use with App Services. This subnet cannot be shared with any other Azure resources.

    • The subnet selected for integration needs to be /28 or larger.

    • If no unused subnets are available, or if all existing subnets are already delegated to other services, you may need to create an additional subnet for the integration.

  7. Select Connect.

    The VNet is integrated.

  8. Allow access for addresses provided in VNet integration firewall requirements to ensure the App Service functions as required.

Step 2: Harden the key vault

Once the Virtual Network (VNet) integration for the Nerdio Manager's App Service is enabled, you can harden the key vault.

To harden the key vault:

  1. In the Azure portal, navigate to Key vaults.

  2. Select the key vault you wish to harden (nmw-app-kv-xxxxxxx).

  3. In the left menu, navigate to Settings > Networking.

  4. In the Firewalls and virtual networks area, enter the following information:

    • Allow access from: Select Allow public access from specific virtual networks and IP addresses.

    • Virtual networks: Select + Add a virtual network.

    • In the Add networks right pane that opens:

      • Virtual networks: From the drop-down list, select the VNet and subnets you wish to use.

      • Subnets: From the drop-down list, select the subnet you wish to use.

    • Select Enable.

      Note

      If you receive a message like this, that means it will take time for the changes to fully take effect.

      The following networks don't have service endpoints enabled for 'Microsoft.KeyVault•. Enabling access will take up to 15 minutes to complete. After starting this operation, it is safe to leave and return later if you do not wish to wait.

      This is normal and expected.

  5. Once you have entered all the desired information, select Save.

Step 3: Create a private endpoint on the key vault

Once the key vault is hardened, create a private endpoint on the key vault.

To create a private endpoint on the key vault:

  1. In the Azure portal, navigate to Key vaults.

  2. Select the Nerdio Manager key vault (nmw-app-kv-xxxxxxx).

  3. In the left menu, navigate to Settings > Networking.

  4. In the Private endpoint connections area, select Create.

  5. In the Create a private endpoint page, provide the following information:

    1. In the Basics area:

      • Subscription: Select the subscription.

        • Resource group: Select the resource group.

      • Name: Enter a custom name for the private endpoint.

      • Network Interface Name: Enter a custom name for NIC.

      • Region: Select the region that contains your VNet.

    2. In the Resource area:

      • Subscription: Select the subscription that contains the key vault.

      • Resource type: Select Microsoft.KeyVault/vaults.

      • Resource: Select your key vault.

      • Target sub-resource: This field is auto-populated with vault after you select the resource.

    3. In the Virtual Network area:

      • Virtual network: Select the VNet that the private endpoints should be deployed to.

      • Subnet: Select the subnet that the private endpoints should be deployed to.

      • Network policy for private endpoints: Optionally, enable this setting if you wish to add NSGs or user-defined routes to the private endpoint subnet.

      • Private IP configuration: Leave the default selection.

      • Application security group: Optionally, add or create an application security group (ASG).

    4. In the DNS area:

      • Private DNS integration: Optionally, depending on your VNet DNS configuration, you may be able to select the Integrate with private DNS zone option.

        Note

        • Most customers specify custom DNS servers targeting their internal AD environment, in which case this option may be disabled.

        • If integration with private DNS zone is not enabled, make sure that the DNS is properly configured to resolve your private endpoint. See Azure Private Endpoint private DNS zone values for details.

    5. In the Review + create area, select Create.

  6. After the private endpoint has been created and DNS has been configured properly, navigate to Firewalls and virtual networks and select Disable public access to enable traffic through the private endpoint.

  7. Clear the Allow trusted Microsoft services option to bypass this firewall.

  8. Select Apply.

Access hardening for key vault

Access hardening controls which identities can read and manage the keys, secrets, and certificates in the key vault, and what they can do with them. Azure Key Vault supports two authorization models: Azure role-based access control (Azure RBAC) and access policies. Access policies are the legacy model. Microsoft recommends Azure RBAC, and uses it by default for new key vaults.

Why Azure RBAC is preferred over access policies

With access policies, anyone who has a role that includes the Microsoft.KeyVault/vaults/write permission, such as Contributor or Key Vault Contributor, can grant themselves access to the key vault's keys, secrets, and certificates by editing an access policy. Azure RBAC removes this risk. Its main advantages are:

  • Tighter control over who can grant access. Only members of the Owner or User Access Administrator roles can grant access to keys, secrets, and certificates. This separates security tasks from administrative tasks.

  • One consistent model. The same role assignments and APIs are used across Azure resources, and administrators get a centralized view of the access that has been granted.

  • Time-limited privileged access. Azure RBAC integrates with Privileged Identity Management, so privileged access rights can expire automatically.

  • Exclusions. Deny assignments can exclude a security principal's access at a given scope.

For more information, see the Microsoft Learn article Azure role-based access control (Azure RBAC) vs. access policies.

Migrate the key vault from access policies to Azure RBAC

Installations of Nerdio Manager before version 8.1 provision the key vault with vault access policies. New installations of version 8.1 and later provision it with Azure RBAC instead. Upgrading Nerdio Manager does not migrate an existing key vault, so a key vault that an earlier version created keeps using access policies until you migrate it manually.

The migration has two stages. First, assign the Azure roles that Nerdio Manager needs. Then switch the key vault's permission model to Azure RBAC.

Warning

Assign the roles in the following table before you switch the permission model. If you switch first, Nerdio Manager loses access to the secrets, keys, and certificates in the key vault.

Assign the following Azure roles on the key vault:

Identity

Roles

The nerdio-nmw-app app registration

Key Vault Certificates Officer and Key Vault Secrets User

The managed identity of the Nerdio Manager App Service (nmw-app-*)

Key Vault Secrets Officer and Key Vault Crypto User. In version 8.1 and later, also Key Vault Certificate User.

Version 8.1 replaced the stored client secret with an app authentication certificate that the App Service reads directly from the key vault. This is why the managed identity needs the Key Vault Certificate User role in version 8.1 and later.

To migrate the key vault to Azure RBAC:

  1. In the Azure portal, navigate to Key vaults.

  2. Select the Nerdio Manager key vault (nmw-app-kv-xxxxxxx).

  3. In the left menu, select Access control (IAM).

  4. Select Add > Add role assignment, and assign each role in the table to its identity.

    Note

    You can add the role assignments while Nerdio Manager is running. They cause no downtime and do not require an App Service restart.

  5. During a maintenance window, in the left menu, navigate to Settings > Access configuration.

  6. For Permission model, select Azure role-based access control, and then select Apply.

For Microsoft's general guidance, see Migrating to Azure RBAC from access policies.

Was this article helpful?

0 out of 0 found this helpful
Have more questions? Submit a request

Related articles

Comments (0 comments)

Please sign in to leave a comment.