Azure Key Vault uses
Secure your Cloud Data
Curso 7 de 8 en Microsoft Azure Developer Associate (AZ-204) Certificado profesional
Azure was designed for security and compliance. in this course, you will learn how to leverage the built-in services to store your app data securely to ensure that only authorized services and clients have access to it. This course will help you prepare for the Microsoft Certified: Azure Developer Associate certification. This course will help you prepare for the Microsoft Certified: Azure Developer Associate certification. In this course, you will take a practice exam that covers key skills measured in the exam. This is the fifth course in a program of 8 courses to help prepare you to take the exam. This course is part of a Specialization intended for developers who want to demonstrate their expertise in all phases of cloud development from requirements, definition, and design; to development, deployment, and maintenance; to performance tuning and monitoring. It is ideal for anyone interested in preparing for the AZ-204: Developing Solutions for Microsoft Azure exam. By the end of this program you will be ready to take and sign-up for the Exam AZ-204: Developing Solutions for Microsoft Azure.
Use Azure RBAC to manage access to resources in Azure, Use access keys to secure networks, Set up policies to protect cloud-based data, Secure web applications on Azure
Secure resources in Microsoft Azure
Storing and handling secrets, encryption keys, and certificates directly is risky, and every usage introduces the possibility of unintentional data exposure. In this module, you will learn how to use Azure Key Vault to provide a secure storage area for managing all your app secrets so you can properly encrypt your data in transit or while it's being stored. You will also learn how to learn how to use Azure RBAC to manage access to resources in Azure.
Lesson introduction1:55
Guidelines for using Azure Key Vault5:28
Azure Key Vault uses4:06
Manage access to secrets, certificates, and keys3:15
Manage certificates4:54
Lesson summary1:09
Now that you're familiar with the basic components of Azure Key Vault, let's look at some of its common uses. There are three key elements to Azure Key Vault; secrets, keys, and certificates. With these three elements, Azure Key Vault addresses the following issues. Azure Key Vault can securely store with HSMs and tightly control access to tokens, passwords, certificates, API keys, and other secrets. Azure Key Vault is a cloud-based key management solution. It makes it easier to create and control the encryption keys used to encrypt your data. Azure services, such as App Service, integrate directly with Azure Key Vault and can decrypt secrets without knowledge of the encryption keys. With Azure Key Vault, you can also provision, manage, and deploy public and private SSL, TLS certificates. These certificates can be used with Azure and your internal connected resources. Finally, the Vault can also request and renew TLS certificates through partnerships with certificate authorities. This provides a robust solution for certificate lifecycle management. Finally, take note of the following important points in relation to Azure Key Vaults. The Key Vault is designed to store configuration secrets for server applications. It's not intended for storing data belonging to your app's users, and it shouldn't be used in the client-side part of an app. This is reflected in its performance characteristics, API, and cost model. User data should be stored elsewhere, such as in an Azure SQL database with transparent data encryption. It can also be held in a storage account with storage service encryption. Secrets used by your application to access those data stores can be kept in Key Vault. Finally, let's review some Azure Key Vault best practices. Grant access to users, groups and applications at a specific scope, control what users have access to, store certificates in your Key Vault, and finally, ensure that you can recover Key Vault or Key Vault objectives if they are accidentally deleted. Use role-based access control or RBAC predefined roles. For example, to grant access to a user to manage Key Vault. To do this, you would assign the predefined role, Key Vault contributor, to this user at a specific scope. The scope, in this case, would be a subscription, a resource group, or just a specific Key Vault. If the predefined roles don't fit your needs, you can define your own roles. Access to a Key Vault is controlled through two separate interfaces, management plane and data plane. The management plane and data plane access controls work independently. Use RBAC to control what users have access to. For example, if you want to grant an application the rights to use keys in a Key Vault, you only need to grant data plane access permissions using Key Vault access policies, no management plane access is needed for this application. Conversely, you might want a user to be able to read Vault properties and tags but not have any access to keys, secrets, or certificates. By using RBAC, you can grant read access to the management plane. No access to the data plane is required. Now that you know how to control user access, take a closer look at storing certificates. Azure Resource Manager can securely deploy certificates stored in Azure Key Vault to Azure VMs when the VMs are deployed. By setting appropriate access policies for the Key Vault, you also control who gets access to your certificate. Another benefit is that you manage all your certificates in one place in Azure Key Vault. Deletion of Key Vaults or Key Vault objects can be either inadvertent or malicious. Enable the soft delete and purge protection features of Key Vault, particularly for keys that are used to encrypt data at rest. Deletion of these keys is equivalent to data loss, so you can recover deleted Vaults and Vault objects if needed. Practice Key Vault recovery operations regularly. Finally, some users have contributor permissions or RBAC to a Key Vault management plane. This means that they can grant themselves access to the data plane by setting a Key Vault access policy, and it's recommended that you tightly control who has contributor access to your Key Vaults. This is to ensure that only authorized persons can access and manage your Key Vaults, keys, secrets, and certificates. You should now be familiar with common use cases of key components in Azure Key Vault. In the next video, we'll look at how to manage these components.