azurekeyvault
seal
The Azure Key Vault seal configures OpenBao to use Azure Key Vault as the seal wrapping mechanism. The Azure Key Vault seal is activated by one of the following:
- The presence of a
seal "azurekeyvault"
block in OpenBao's configuration file. - The presence of the environment variable
VAULT_SEAL_TYPE
set toazurekeyvault
. If enabling via environment variable, all other required values specific to Key Vault (i.e.VAULT_AZUREKEYVAULT_VAULT_NAME
, etc.) must be also supplied, as well as all other Azure-related environment variables that lends to successful authentication (i.e.AZURE_TENANT_ID
, etc.).
azurekeyvault
example
This example shows configuring Azure Key Vault seal through the OpenBao configuration file by providing all the required values:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
client_secret = "DUJDS3..."
vault_name = "hc-openbao"
key_name = "openbao_key"
}
azurekeyvault
parameters
These parameters apply to the seal
stanza in the OpenBao configuration file:
-
tenant_id
(string: <required>)
: The tenant id for the Azure Active Directory organization. May also be specified by theAZURE_TENANT_ID
environment variable. -
client_id
(string: <required or MSI>)
: The client id for credentials to query the Azure APIs. May also be specified by theAZURE_CLIENT_ID
environment variable. -
client_secret
(string: <required or MSI>)
: The client secret for credentials to query the Azure APIs. May also be specified by theAZURE_CLIENT_SECRET
environment variable. -
environment
(string: "AZUREPUBLICCLOUD")
: The Azure Cloud environment API endpoints to use. May also be specified by theAZURE_ENVIRONMENT
environment variable. -
vault_name
(string: <required>)
: The Key Vault vault to use the encryption keys for encryption and decryption. May also be specified by theVAULT_AZUREKEYVAULT_VAULT_NAME
environment variable. -
key_name
(string: <required>)
: The Key Vault key to use for encryption and decryption. May also be specified by theVAULT_AZUREKEYVAULT_KEY_NAME
environment variable. -
resource
(string: "vault.azure.net")
: The AZ KeyVault resource's DNS Suffix to connect to. May also be specified in theAZURE_AD_RESOURCE
environment variable. Needs to be changed to connect to Azure's Managed HSM KeyVault instance type. -
disabled
(string: "")
: Set this totrue
if OpenBao is migrating from an auto seal configuration. Otherwise, set tofalse
.
Refer to the Seal Migration documentation for more information about the seal migration process.
Authentication
Authentication-related values must be provided, either as environment variables or as configuration parameters.
Azure authentication values:
AZURE_TENANT_ID
AZURE_CLIENT_ID
AZURE_CLIENT_SECRET
AZURE_ENVIRONMENT
AZURE_AD_RESOURCE
Note: If OpenBao is hosted on Azure, OpenBao can use Managed Service Identities (MSI) to access Azure instead of an environment and shared client id and secret. MSI must be enabled on the VMs hosting OpenBao, and it is the preferred configuration since MSI prevents your Azure credentials from being stored as clear text.
Note: If you are using a Managed HSM KeyVault, AZURE_AD_RESOURCE
or the resource
configuration parameter must be specified; usually this should point to managedhsm.azure.net
,
but could point to other suffixes depending on Azure environment.
azurekeyvault
environment variables
Alternatively, the Azure Key Vault seal can be activated by providing the following environment variables:
VAULT_AZUREKEYVAULT_VAULT_NAME
VAULT_AZUREKEYVAULT_KEY_NAME
Key rotation
This seal supports rotating keys defined in Azure Key Vault. Key metadata is stored with the encrypted data to ensure the correct key is used during decryption operations. Simply set up Azure Key Vault with key rotation using Azure Automation Account and OpenBao will recognize newly rotated keys.