|
azure-security-keyvault-administration
|
|
|
azure-security-keyvault-administration
|
Azure Key Vault Managed HSM is a fully-managed, highly-available, single-tenant, standards-compliant cloud service that enables you to safeguard cryptographic keys for your cloud applications using FIPS 140-2 Level 3 validated HSMs.
Azure Security Keyvault Administration Package client library for C++ (azure-security-keyvault-administration) matches necessary patterns that the development team has established to create a unified SDK written in the C++ programming language. These libraries follow the Azure SDK Design Guidelines for C++.
The library allows client libraries to expose common functionality in a consistent fashion. Once you learn how to use these APIs in one client library, you will know how to use them in other client libraries.
Source code | API reference documentation | Product documentation
Install the Azure Key Vault Administration Setting client library for C++ with vcpkg:
To create a Managed HSM resource, run the following CLI command:
To get <your-user-object-id> you can run the following CLI command:
All data plane commands are disabled until the HSM is activated. You will not be able to create keys or assign roles. Only the designated administrators that were assigned during the create command can activate the HSM. To activate the HSM you must download the security domain.
To activate your HSM you need:
To activate the HSM you send at least 3 (maximum 10) RSA public keys to the HSM. The HSM encrypts the security domain with these keys and sends it back. Once this security domain is successfully downloaded, your HSM is ready to use. You also need to specify quorum, which is the minimum number of private keys required to decrypt the security domain.
The example below shows how to use openssl to generate 3 self-signed certificates.
Use the az keyvault security-domain download command to download the security domain and activate your managed HSM. The example below uses 3 RSA key pairs (only public keys are needed for this command) and sets the quorum to 2.
The designated administrators assigned during creation are automatically added to the "Managed HSM Administrators" built-in role, who are able to download a security domain and manage roles for data plane access, among other limited permissions.
To perform other actions on keys, you need to assign principals to other roles such as "Managed HSM Crypto User", which can perform non-destructive key operations:
Please read best practices for properly securing your managed HSM.
We guarantee that all client instance methods are thread-safe and independent of each other (guideline). This ensures that the recommendation of reusing client instances is always safe, even across threads.
Replaceable HTTP transport adapter | Long-running operations |
For detailed samples please review the code provided.
To get all the available settings present on the Keyvault instance we will first create a client :
Please note that we are using the HSM URL, not the keyvault URL.
To get the settings we will call the GetSettings API
To get a specific setting we will call the GetSetting API bassing the setting name as a string parameter.
To update the value of any of the the available settings, we will call the UpdateSettings API as follows:
To create a new BackupClient to perform these operations, you need the endpoint to an Azure Key Vault HSM and credentials.
Key Vault BackupClient client for C++ currently supports any TokenCredential for authenticating.
Then, in the sample below, you can set keyVaultUrl based on an environment variable, configuration setting, or any way that works for your application.
Since these operations require a blob storage for the backup/restore operations, a SAS token is required for the connection between the services(Key Vault and Storage).
In this sample we rely on a couple of extra environment variables.
Since this is a long running operation the service provides endpoints to determine the status while the opperation is running.
In order to wait for the operation to complete we will call the polling method.
Similar to the backup operation after we initialize the operation we can check the status.
the restore operation requires a folder where a backup was previously performed along side the SAS token parameter.
Similar to the backup operation after we initialize the operation we can check the status.
The selective restore operation requires a folder where a backup was previously performed along side the SAS token parameter.
For details on contributing to this repository, see the contributing guide.
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit the Contributor License Agreement.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
Many people all over the world have helped make this project better. You'll want to check out:
Security issues and bugs should be reported privately, via email, to the Microsoft Security Response Center (MSRC) secur.nosp@m.e@mi.nosp@m.croso.nosp@m.ft.c.nosp@m.om. You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Further information, including the MSRC PGP key, can be found in the Security TechCenter.
1.9.7