Managing Azure Secrets

This section describes how to manage Azure Secrets on CCKM. Before proceeding, you must have an Azure key vault added to the CCKM. Refer to Managing Azure Vaults for details.

Adding Azure Secrets

To add an Azure Secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The Add Secret wizard is displayed.

4. Enter Secret Name.

5. Enter Secret Value.

6. Select the desired Vault from the drop-down list. Vaults stored in Azure Managed HSM pools are not supported.

7. Enter Content Type.

8. (Optional) Set the secret activation and expiration dates.

   • Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the secret.

   • Select the Set Expiration Date check box and from the on-screen calendar, select the secret expiration date and time.

9. (Optional) Enter Tags. A tag is a label assigned to the key that consists of a user-defined key and a value.

   To add a tag:

   1. Specify a tag name.

   2. Specify the tag value.

      • CCKM allows the following characters in tag values:

        • Alphanumeric characters

        • Special characters ** ! @ # $ % ) ( { } > < ? + - / \ [ ] ^ & + = | ~ ` , ; . ' " _ **

      • CCKM does not allow the colon (:) in tag values.

   3. Click the + button.

   Similarly, you can add more tags. To remove a tag, click the close (X) icon in the tag name.

10. Click Save.

Viewing Azure Secrets

Search for Azure Secrets by Secret Name.

CCKM does not allow searching for secrets:

• By tag values using colon (:)

• By "secret:value" pair using these characters:

  \ , : " %

To view an Azure secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed. The Azure Secrets tab displays the following details:

   Field	Description
   Secret Name	Unique, user-friendly alias of the secret. This is useful in searching for specific secrets.
   Version ID	Current version of the secret. Click the expand icon () corresponding to a secret to view its versions.
   Status	State of the secret. The status can be: • Available • Soft Deleted • Deleted
   Cloud	Name of the cloud.
   Creation Date	Date and time when the secret is created.
   Expiry Date	Date and time when the secret will expire.
   Key Vault	Name of the Azure key vault.
   Region	Azure region where the secret is created. Click the filter icon () to view the list of supported Azure regions.

Sometimes, you might notice certain secrets are displayed as grayed out. This happens when the secrets are no longer accessible. For example, when:

• Any cloud permissions on the secrets are changed. The secrets are no longer accessible from the Azure connection.

• Connection is changed in KMS. The new connection does not have permissions to access the secrets.

Refreshing Azure Secrets

Refreshing is the process of downloading secrets created on the Azure key vault to CCKM. Secrets from all key vaults are refreshed at once.

To refresh secrets:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click Refresh. The This may take a while... message is displayed.

   Note

   Refresh is a time intensive operation that could take several hours or days to complete. It will continue running in the background. Do you want to continue?

5. Click Refresh to continue.

A message Refresh started... is displayed on the screen. The refreshed secrets are listed on the Cloud Keys > Azure > Secrets tab.

To cancel the refresh.

1. Click Cancel Refresh. The Cancel Refresh? message is displayed. The action will terminate all currently active refresh operations. All progress will be lost and this action cannot be undone. Do you want to proceed to cancel refresh or cancel this action?

2. Click Cancel Refresh.

A message Refresh cancelled successfully is displayed on the screen.

Rotating Secrets (Add Version)

To rotate a secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click the overflow icon () corresponding to the desired alias and click Rotate Now (Add Version). The Add New Version screen is displayed.

5. Enter Secret Value.

6. Select the desired Vault from the drop-down list.

7. Enter Content Type.

8. (Optional) Set the secret activation and expiration dates.

   • Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the secret.

   • Select the Set Expiration Date check box and from the on-screen calendar, select the secret expiration date and time.

9. (Optional) Enter Tags. A tag is a label assigned to the key that consists of a user-defined key and a value.

   To add a tag:

   1. Specify a tag name.

   2. Specify the tag value.

      • CCKM allows the following characters in tag values:

        • Alphanumeric characters

        • Special characters ** ! @ # $ % ) ( { } > < ? + - / \ [ ] ^ & + = | ~ ` , ; . ' " _ **

      • CCKM does not allow the colon (:) in tag values.

   3. Click the + button.

   Similarly, you can add more tags. To remove a tag, click the close (X) icon in the tag name.

10. Click Save.

A message Secret successfully rotated is displayed on the screen. Navigate to Cloud Keys > Azure > View/Edit > Versions to view the versions of the rotated Azure secret.

Soft-Deleting Azure Secrets

Soft deleting is the process of deleting Azure secrets from the Azure vaults and CCKM. These secrets still exist on CCKM and in the Azure vaults. The soft-deleted secrets can be recovered.

To soft-delete an Azure secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click the overflow icon () corresponding to the desired alias and click Soft Delete. The Confirm Soft Delete dialog box is displayed.

5. Click Soft Delete.

A message Secret <secret name> soft-deleted is displayed on the screen. The status of the secret changes to SOFT-DELETED.

Recovering Soft-Deleted Azure Secrets

If needed, you can recover a soft-deleted secret.

To recover a soft-deleted Azure secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click the overflow icon () corresponding to the desired alias and click Recover. The Confirm Recover Secret dialog box is displayed.

5. Click Recover.

A message Secret <secret name> recovered from soft-delete. is displayed on the screen. The status of the secret changes to AVAILABLE.

Purging Azure Secrets

Purging is the process of permanently deleting soft-deleted Azure secrets from the Azure vaults. However, backup of the purged secret can be restored on CCKM. If you wish to restore backup of the purged secret, follow the steps mentioned in the Restoring Backup section.

To purge an Azure secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click the overflow icon () corresponding to the desired alias and click Purge. The Purge Azure secret dialog box is displayed.

5. Select the I wish to purge this secret. check box.

6. Click Purge Secret.

Purging a secret might take some time. After successful deletion, a message Secret <secret name> hard deleted is displayed on the screen. The status of the secret changes to DELETED.

If needed, you can restore a purged secret from its backup. Refer to Restoring Backup for details.

Restoring Backup

To restore a purged Azure secret:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click the overflow icon () corresponding to the desired alias and click Restore. The Confirm Restore secret dialog box is displayed.

5. Select the desired secret vault from the Select Vault drop-down list.

   Note

   Restoration of secrets among cross-region vaults is not allowed.

6. Click Restore Secret.

A message Secret <secret name> restored is displayed on the screen. The secret is restored to the selected key vault. The secret status changes to AVAILABLE.

Deleting Backup

Deleting a backup permanently removes the backup of a deleted Azure secret from CCKM.

To delete the backup of an Azure secret from CCKM:

1. Open the Cloud Key Manager application.

2. In the left pane, click Cloud Keys > Azure.

3. Click the Secrets tab. The list of available Azure secrets is displayed.

4. Click the overflow icon () corresponding to the desired alias and click Delete Backup. The Hard Delete Azure Secret dialog box is displayed.

5. Select the I wish to delete the backup of this secret. check box.

6. Click Delete Secret Backup.

A message Secret <secret name> backup deleted is displayed on the screen. The backup of the secret is permanently deleted from CCKM.