z13 ‐ Vault, key and Key Rotation - SanjeevOCI/Azure GitHub Wiki

Creating a Key Vault

From the left-hand menu, select “All Services” then in the “Security” section , select Key Vault and click on Create.

13_Vault_Key_and_Key_Rotation_1

Fill in the required details and click on “Review+Create” and Create.

13_Vault_Key_and_Key_Rotation_2

We can now see the Key Vault is created,

13_Vault_Key_and_Key_Rotation_3

Create a Key in the Key Vault

In the Azure Portal, Go to “Key Vaults” and select the Key Vault.

In the Key Vault settings, select “Keys” and click on “+Generate/Import”.

13_Vault_Key_and_Key_Rotation_4

The error message "The operation is not allowed by RBAC. If role assignments were recently changed, please wait several minutes for role assignments to become effective." indicates that our Azure user/account does not have the required RBAC (Role-Based Access Control) permissions to perform the action (e.g., generate/import keys) in the Azure Key Vault.

To fix this,

  1. Navigate to Key Vault --> Access Configuration --> Check if it's using Azure RBAC or Vault access policy.

Vault_Key_and_Key_Rotation_Error_Resolution_1

  1. As Azure RBAC is being used, we need to assign Key Vault Administrator (Full access) or Key Vault Crypto Officer (for keys only). we will go with Key Vault Administrator role.

  2. To assign the role, Navigate to Key Vault --> Access control (IAM) --> Click + Add --> Add role assignment --> Select "Key Vault Administrator" --> Assign to your user account, group, or service principal --> Click Save.

Vault_Key_and_Key_Rotation_Error_Resolution_2

Vault_Key_and_Key_Rotation_Error_Resolution_7

  1. RBAC assignments can take 5–10 minutes to take effect. Wait a few minutes before retrying.

  2. After few minutes, Navigate to Key Vault settings, select “Keys” and click on “+Generate/Import”. We do not see the error message now.

  3. Fill the required details and click on “Create”.

Vault_Key_and_Key_Rotation_Error_Resolution_8

Vault_Key_and_Key_Rotation_Error_Resolution_9

We can see the key is created.

Vault_Key_and_Key_Rotation_Error_Resolution_10

Rotate the Key

In the Key Vault settings, select “Keys”, and select the key which we want to rotate. Click on “New Version”.

13_Vault_Key_and_Key_Rotation_6

Fill the required details and click on “Create”.

13_Vault_Key_and_Key_Rotation_7

We can now see the new key is created,

13_Vault_Key_and_Key_Rotation_8

Automate Key Rotation

We also have an option to automate this key rotation.

For this we have to go into key we want to rotate and click on “Rotation Policy”.

13_Vault_Key_and_Key_Rotation_9

Select the rotation policy and “Enable” auto rotation.

13_Vault_Key_and_Key_Rotation_10

Click on Save and then the key will be automatically rotated as per the rotation policy.

13_Vault_Key_and_Key_Rotation_11