Creating an Azure Key
Create an Azure Key using the Azure Portal
This section describes how to create an Azure Key using the Azure portal.
To create an Azure Key:
Login to the Azure environment.
Click the Portal menu icon.
The Portal menu appears.
Navigate to All services.
The All services screen appears.
Select Key vaults under the SECURITY section.
The Key vaults screen appears.
Click Add.
The Create key vault screen appears.
On the Basics tab, enter the following details:
Field Description Subscription By default, Azure Cloud Platform is selected. Resource group Select the required resource group. Key vault name Enter a name for your key vault. Region Select a region where the key vault will be created. Pricing tier Select a pricing tier. For example, Standard or Premium. Click Next to navigate to the Access policy tab.
The Access policy tab appears.
Click Next to navigate to the Virtual network tab.
Click Next to navigate to the Tags tab.
Add tags to the key vault, if required.
Tags are name-value pairs for categorizing the key vault resource.
Click Review + create to validate the key vault configuration.
Azure validates the information that you have entered.
Click Create to create the required key vault.
The key vault is created and the following screen appears.
Click Go to resource.
The Overview screen appears displaying information about the key vault that you have created.
On the left pane, under the Settings section, click Keys.
The Keys screen appears.
Click Generate/Import to create a key.
The Create a key screen appears.
Enter the following details for the key.
Field Description Options Select Generate to generate the key. Name Enter the name for your Azure key. Key Type Specify the key type. Select RSA. RSA Key Size Specify the key size for RSA. Select the value as 3072. Enabled Select Yes to enable the key. Click Create.
The key is created.
Click the key name.
The Versions screen for the key appears. It lists all the versions for the key.
Click the specific key version.
The Key Version screen appears. This screen displays the properties and settings for the specific key version.
Click the icon next to the Key Identifier field to copy the field value to the clipboard.
A message appears informing that the identifier has been copied.
The following is an example of an Azure key identifier:
https://<Key_Vault_Name>.vault.azure.net/keys/<Key_Name>/0a5e4ea190a24707983ffd0efcc03c8a
You need to paste this identifier as the value of the public key label for encrypting the policy.
For more information about using the public key for encrypting the policy, refer to the section [Retrieving the Policy from the ESA](/docs/rest_container/iap_rest_installation/iap_rest_aws_azure_installation/iap_rest_using_devops/iap_rest_retrieving_package_from_esa/).
- In the Permitted operations section, select the Decrypt check box and clear all the remaining check boxes.
This ensures that only the **Decrypt** operation is permitted for the Azure key.
- Click Save to save the changes.
Creating an Azure Key using the CLI
This section describes how to create an Azure Key using the CLI.
- Run the following command to create the Azure Key Vault.
az keyvault create -g $RG -n $VAULT -l $LOC --enable-rbac-authorization true
In this command:
RG: Environment variable for the Azure Resource Group.VAULT: Environment variable for the Azure Key Vault.LOC: Environment variable for the account default region.
- Run the following command to create the Azure key to be used for encrypting the policy package.
az keyvault key create --vault-name $VAULT --name $KEY --kty RSA --size 2048 --ops decrypt encrypt
- Run the following command to generate the public key.
az keyvault key download \
--vault-name pty-kv-dev-01 \
--name pty-kek \
--file pub.pem
awk 'BEGIN{ORS="\\n"}1' pub.pem
The output displays the Key ID of the public key and the value of the public key in JSON format.
For more information about using the public key for encrypting the policy, refer to the section Retrieving the Policy from the ESA.
Feedback
Was this page helpful?