App Tier Customer-Managed Key In Use

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and identify the tag set defined for the Azure cloud resources provisioned in your app tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Sign in to Azure Management Portal.

03 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

04 Choose the Azure subscription that you want to access from the Subscription filter box.

05 From the Type filter box, select Key vault to list all Key Vault instances available in the selected subscription.

06 Click on the name of the Azure Key Vault that you want to examine.

07 In the navigation panel, under Settings, select Keys, to access the Customer-Managed Keys (CMKs) deployed within the selected vault.

08 Choose the active CMK that you want to examine, then click on the current (latest) version of the key, to access the key configuration details.

09 On the selected key configuration page, choose the Tags tab and check the tag set created for the selected CMK. If the tag set does not match the one identified at step no. 1 or the key does not have any tags defined at all, the selected Customer Master Key (CMK) is not an app-tier resource.

10 Repeat step no. 8 and 9 for each CMK deployed in the selected Azure Key Vault.

11 Repeat steps no. 6 – 10 for each Key Vault available in the selected subscription. If none of the verified keys have the required app-tier tags, there is no Azure Customer Master Key (CMK) created and configured for your application tier, within the selected Azure subscription.

12 Repeat steps no. 4 – 11 for each subscription created in your Microsoft Azure cloud account.

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and identify the tag set defined for the Azure cloud resources provisioned in your app tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Run keyvault list command (Windows/macOS/Linux) using custom query filters to list the names of all Key Vault instances available in the current Azure subscription:

az keyvault list
	--query '[*].name'

03 The command output should return the requested Azure resource names:

[
  "cc-project5-key-vault",
  "cc-user-access-vault"
]

04 Run keyvault key list command (Windows/macOS/Linux) using the name of the Azure Key Vault instance that you want to examine as identifier parameter and custom query filters to list the IDs of the Customer Master Keys (CMKs) available in the selected vault:

az keyvault key list
	--vault-name "cc-project5-key-vault"
	--query '[?(attributes.enabled==`true`)].kid'

05 The command output should return the requested CMK identifiers (IDs):

[
 "https://cc-project5-key-vault.vault.azure.net/keys/cc-development-cmk",
 "https://cc-project5-key-vault.vault.azure.net/keys/cc-project5-cmk"
]

06 Run keyvault key show command (Windows/macOS/Linux) using the ID of the Azure Customer Master Key that you want to examine as identifier parameter and custom query filters to describe the tag set(s) defined for the selected Azure resource:

az keyvault key show
	--id "https://cc-project5-key-vault.vault.azure.net/keys/cc-development-cmk"
	--query 'tags'

07 The command output should return an object that contains the tag set(s) configured for the selected CMK:

{
  "ProjectName": "Project5"
}

08 Repeat step no. 6 and 7 for each CMK created within the selected Azure Key Vault.

09 Repeat steps no. 4 – 8 for each Key Vault available in the selected subscription. If none of the verified keys have the necessary app-tier tags, there is no Azure Customer Master Key (CMK) created and configured for your application tier, within the selected Azure subscription.

10 Repeat steps no. 2 – 9 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and copy the tag set defined for the cloud resources created within your application tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Sign in to Azure Management Portal.

03 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

04 Choose the Azure subscription that you want to access from the Subscription filter box.

05 From the Type filter box, select Key vault to list all Key Vault instances available in the selected subscription.

06 Click on the name of the Azure Key Vault that you want to access.

07 In the navigation panel, under Settings, select Keys, then click on the Generate/Import button from the dashboard top menu to initiate the Customer-Managed Key setup process.

08 On the Create a key page, perform the following operations:

1. Select Generate from the Options dropdown list to generate a new key.
2. In the Name box, provide a unique name for your new CMK.
3. Select RSA from the Key Type and 2048 from the RSA Key Size.
4. Set an activation and/or expiration date for the resource using the Set activation date and Set expiration date controls.
5. Select Yes for Enabled to activate the key immediately after creation.
6. Click Create to generate your new Customer-Managed Key (CMK).

09 Select the newly created CMK, then click on the current version of the key to access the resource latest configuration.

10 On the selected key configuration page, choose the Tags tab and use the Tag Name and Tag Value fields to create tags that will help organize the identity of the new CMK. Use the following format when you define your own tag set: <app_tier_tag>:<app_tier_tag_value> and make sure the tag name (<app_tier_tag>) and the tag value (<app_tier_tag_value>) match the tag set used to organize your app-tier cloud resources, copied at step no. 1. Click Ok to apply the tag set.

11 If required, repeat steps no. 4 – 10 to create new, dedicated app-tier Customer-Managed Keys (CMKs) for other subscriptions available in your Microsoft Azure cloud account.

01 Sign in to your Cloud Conformity console, access App Tier Customer-Managed Key In Use conformity rule settings and copy the tag set defined for the cloud resources created within your application tier (e.g. <app_tier_tag>:<app_tier_tag_value>).

02 Run keyvault key create command (Windows/macOS/Linux) to create the new Customer-Managed Key (CMK)/Bring Your Own Key (BYOK) required by the Microsoft Azure cloud resources provisioned inside your application tier, in the current Azure subscription. Use the following format when you define your own tag set: <app_tier_tag>:<app_tier_tag_value> and make sure the tag name (app_tier_tag) and the tag value (app_tier_tag_value) match the tag set used to organize your app-tier resources, copied at step no. 1:

az keyvault key create
	--name cc-app-tier-cmk
	--vault-name cc-project5-key-vault
	--kty RSA
	--size 2048
	--ops decrypt encrypt sign unwrapKey verify wrapKey
	--expires "2020-12-17T20:00:00Z"
	--protection software
	--disabled false
	--tags app_tier_tag=app_tier_tag_value

03 The command output should return the configuration metadata for the new app-tier key:

{
  "attributes": {
    "created": "2019-12-17T20:00:10+00:00",
    "enabled": true,
    "expires": "2020-12-17T20:00:00+00:00",
    "notBefore": null,
    "recoveryLevel": "Purgeable",
    "updated": "2019-12-17T20:00:10+00:00"
  },
  "key": {
    "crv": null,
    "d": null,
    "dp": null,
    "dq": null,
    "e": "AQAB",
    "k": null,
    "keyOps": [
      "decrypt",
      "encrypt",
      "sign",
      "unwrapKey",
      "verify",
      "wrapKey"
    ],
    "kid": "https://cc-project5-key-vault.vault.azure.net/keys/cc-app-tier-cmk/abcdabcdabcdabcdabcdabcdabcdabcd",
    "kty": "RSA",
    "n": "...",
    "p": null,
    "q": null,
    "qi": null,
    "t": null,
    "x": null,
    "y": null
  },
  "managed": null,
  "tags": {
    "app_tier_tag": "app_tier_tag_value"
  }
}

04 If required, repeat step no. 2 and 3 to create new, dedicated app-tier Customer-Managed Keys (CMKs) for other subscriptions available in your Microsoft Azure cloud account.