HashiConf 2024 Now streaming live from Boston! Attend for free
Nomad
Nomad Home

azurekeyvault keyring

The AWS KMS keyring configures Nomad to use AWS KMS to wrap its keyring. This example shows configuring Azure Key Vault keyring through the Nomad configuration file by providing all the required values.

seal "azurekeyvault" {
  active = true
  name   = "example"

  # fields specific to azurekeyvault
  tenant_id      = "46646709-b63e-4747-be42-516edeaf1e14"
  client_id      = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
  client_secret  = "DUJDS3..."
  vault_name     = "nomad"
  key_name       = "nomad_key"
}

azurekeyvault parameters

These parameters apply to the keyring block in the Nomad configuration file:

  • tenant_id (string: <required>): The tenant id for the Azure Active Directory organization. Alternately specify via the AZURE_TENANT_ID environment variable.

  • client_id (string: <required or MSI>): The client id for credentials to query the Azure APIs. Alternately specify via the AZURE_CLIENT_ID environment variable.

  • client_secret (string: <required or MSI>): The client secret for credentials to query the Azure APIs. Alternately specify via the AZURE_CLIENT_SECRET environment variable.

  • environment (string: "AZUREPUBLICCLOUD"): The Azure Cloud environment API endpoints to use. Alternately specify via the AZURE_ENVIRONMENT environment variable.

  • vault_name (string: <required>): The Key Vault vault to use the encryption keys for encryption and decryption.

  • key_name (string: <required>): The Key Vault key to use for encryption and decryption.

  • resource (string: "vault.azure.net"): The AZ KeyVault resource's DNS Suffix to connect to. Alternately specify via the AZURE_AD_RESOURCE environment variable. Needs to be changed to connect to Azure's Managed HSM KeyVault instance type.

Authentication

You must provide authentication-related values either as environment variables or as configuration parameters.

Azure authentication values:

Note: If Nomad is hosted on Azure, Nomad can use Managed Service Identities (MSI) to access Azure instead of an environment and shared client id and secret. MSI must be enabled on the VMs hosting Nomad. We recommend this configuration since MSI prevents your Azure credentials from being stored as clear text.

Note: If you are using a Managed HSM KeyVault, you must specify AZURE_AD_RESOURCE or the resource configuration parameter; usually this should point to managedhsm.azure.net but could point to other suffixes depending on Azure environment.

Key rotation

This keyring supports rotating keys defined in Azure Key Vault. Key metadata is stored with the encrypted data to ensure the correct key is used during decryption operations. Set up Azure Key Vault with key rotation using Azure Automation Account so Vault recognizes newly rotated keys.

Edit this page on GitHub