Integrate with Azure Key Vault

1. Navigate to the Register an application in the Azure Portal.

2. Provide a Name and select the Supported account types for the application.

3. Click Register.

4. Navigate to the EntraID overview page and click App registrations.

5. Click the app you previously created.

6. Make note of the Application (client) ID and Directory (tenant) ID. You will need these to configure the HCP Vault Secrets integration.

7. Click Certificates & secrets.

8. Click New client secret.

9. Enter a description and select the desired expriation period.

10. Click Add.

11. Make note of the client secret Value. You will need this to configure the HCP Vault Secrets integration.

12. Navigate to the desired Key Vault.

13. Click Access policies and click Create.

14. Under Secret permissions select Set, Delete, and Recover.

15. Under Privileged Secret Operations select Purge.

16. Click Next.

17. Search for and select the EntraID app previously created.

18. Click Next.

19. Click Next again, then click Create.

    Note

    In addition to access policies, Azure Key Vault also supports permission using roles. If you prefer using roles, click Access control (IAM) and add an assignment with the Key Vault Administrator job function role.

20. Return to the key vault overview page and make note of the Vault URI. You will need this to configure the HCP Vault Secrets integration.

You can use the Terraform Azure provider to provision an app registration and client secret with the required policy.

1. Follow the Terraform documentation to authenticate the Azure provider.

2. Create a Terraform configuration to create the Azure EntraID app registration, and client secret.

   provider "azuread" {
     # See https://registry.terraform.io/providers/hashicorp/azuread/latest/docs
   }
   provider "azurerm" {
     # See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs for options on how to configure this provider.
     features {}
   }
   variable "key_vault_name" {
     description = "The name of the Key Vault to use."
   }
   variable "key_vault_location" {
     description = "The Azure region where the Key Vault is hosted."
   }
   variable "key_vault_resource_group_name" {
     description = "The name of the resource group where the Key Vault instance is part of."
   }
   data "azurerm_client_config" "current" {}
   resource "azuread_application" "hcp_vault_secrets_integration" {
     display_name = "hcp-vault-secrets-sync"
   }
   resource "azuread_service_principal" "hcp_vault_secrets_integration" {
     client_id = azuread_application.hcp_vault_secrets_integration.client_id
   }
   resource "azuread_application_password" "hcp_vault_secrets_integration" {
     application_id = azuread_application.hcp_vault_secrets_integration.id
     end_date       = "2099-01-01T01:01:01Z" # Far-future expiration date, follow your organization's recommended policy
   }
   data "azurerm_resource_group" "hcp_vault_secrets_integration" {
     name     = var.key_vault_resource_group_name
   }
   data "azurerm_key_vault" "hcp_vault_secrets_integration" {
     name                = var.key_vault_name
     resource_group_name = data.azurerm_resource_group.hcp_vault_secrets_integration.name
   }
   resource "azurerm_key_vault_access_policy" "hcp_vault_secrets_integration" {
     key_vault_id = data.azurerm_key_vault.hcp_vault_secrets_integration.id
     tenant_id    = data.azurerm_client_config.current.tenant_id
     object_id    = azuread_service_principal.hcp_vault_secrets_integration.object_id
     secret_permissions = [
       "Delete",
       "Set",
       "Purge",
     ]
   }
   output "key_vault_uri" {
     value = data.azurerm_key_vault.hcp_vault_secrets_integration.vault_uri
   }
   output "tenant_id" {
     value = data.azurerm_client_config.current.tenant_id
   }
   output "client_id" {
     value = azuread_application.hcp_vault_secrets_integration.client_id
   }
   output "client_secret" {
     value     = azuread_application_password.hcp_vault_secrets_integration.value
     sensitive = true # use terraform output -json to see the sensitive value if running locally
   }
   

3. Initialize Terraform.

   $ terraform init
   
   ...snip...
   
   Terraform has been successfully initialized!
   
   

4. Run terraform apply to generate the client secret.

   $ terraform apply
   

5. Copy the credentials from the Terraform output.

   Apply complete! Resources: 6 added, 0 changed, 0 destroyed.
   
    Outputs:
   
    client_id = "db1f4605-c1af-4661-adfa-9fdc9b11111c"
    client_secret = <sensitive>
    key_vault_uri = "https://hcp-vault-secrets-sync.vault.azure.net/"
    tenant_id = "0f6774c2-86e4-4c9f-82ad-77c1123nh758"