Azure Key Vault
We are listening! Please take a few moments to submit your ideas or up-vote already submitted ideas by others. Azure Key Vault team regularly monitors and reviews all feedback submitted on this forum. You will be one of the first to know when a requested feature will be worked on! So be sure to vote or submit your ideas! Remember this site is for feature suggestions and ideas. For technical questions please try documentation, MSDN Forum or StackOverFlow
-
Allow key vault references without version
It was previously possible to reference key vault settings without specifying the secret version in the URL. i.e. https://myvault.vault.azure.net/secrets/mysecret/
And would automatically reference the most current version of the secret.
This functionality stopped working after a rollout on 9 August 2019.
This is a very useful feature when you need to use secrets across different environments as it is cumbersome to update the references whenever a secret needs to be updated.
1 vote -
keyvault version control and management
enable versioning and tagging of entire keyvault properties to enable quick switching between configurations
AND/OR enable online backup of keyvault to achieve the same effect
Additionally, the keyvault user interface is very hard and inefficient to make a lot of changes and is error prone, so an improved table based UI might help ?
1 vote -
Allow ALL PaaS services to be trusted by KeyVault. Without this, firewall rules are unmanageable
Allow all PaaS services to be trusted by KeyVault. Without this, firewall rules are unmanageable. Data factory has dynamic IPs, MIcrosoft solution to me was to add the 220 IP ranges for West US 2. Sadly, KeyVault only allows 127 entries. - Solution? Use the self hosted runtimes (higher cost). My solution if you want Key Vault to be enterprise ready, in the firewall screen, make it as simple as explicitly selecting an Azure service and saying - allow access - why do I have to figure out IP ranges? (too many anyway).Lets help the Azure Key Vault product team…
1 vote -
Support for nCipher HSM and CNG
Currently, Azure Key vault HSM doesn't support nCipher HSM and CNG ("nCipher World Key Provider"). Due to this we are not able to migrate few of our services to Azure and it become bottleneck for migration.
1 vote -
Key Vault Access Policies - Provide Identifier next to SP.
In some scenarios there can be 2 service principals created in Azure AD such as function apps which have been re created and have the same name, by providing the Id next to the name it will allow contributors to verify they have selected the correct service principal to grant access to, and not old SP's
1 vote -
improve client exceptions around auth failures due to traffic routing failures
I just spent a couple days trying to figure out why we couldn't use a service principal to auth against KeyVault from our on prem servers.
It turned out we had failed to setup SNAT rules for a bank of machines, but none of the exceptions emitted by the client libraries were at all helpful in figuring this out.
I've attached sample exceptions we got from the 2 different versions of the nuget packages we tried, but it was basically these 2 messages:
Exception Message: Access token could not be acquired. Object reference not set to an instance of an…
1 vote -
Fix the article on Key Vault backups
This article https://blogs.technet.microsoft.com/kv/2018/07/20/announcing-backup-and-restore-of-keys-secrets-and-certificates/ has some pretty major errors, such as stating that the CLI command line to backup a secret is the same as the one to backup a key. Someone needs to review and correct this article.
1 vote -
nCipher Security has only one product, general purpose HSM
LOL, this happen if somebody is not doing his work properly and only rename vendor.
nCipher Security has only general purpose HSM and has no activities in NATO or with payment solution. The text is about Thales company.nCipher Security is a leading global provider of data encryption and cyber security solutions to the financial services, high technology, manufacturing, government, and technology sectors. With a 40-year track record of protecting corporate and government information, nCipher Security cryptographic solutions are used by four of the five largest energy and aerospace companies. Their solutions are also used by 22 NATO countries/regions, and…
1 vote -
Simplify key rotation process
Make it easier to rotate keys. Currently, when creating a new version it becomes the default version immediately - which makes the process very risky. It will be better to be able to do this process manually (marking a key as default) - so I can do it when I'm ready. Or, even better - support decrtpting using the old keys like AWS KMS or GCP KMS are doing.
References:
https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
https://cloud.google.com/kms/docs/key-rotation2 votes -
Accessing KeyVault from HDInsight cluster
My team is starting a new project which involves running .NET app on HDI cluster. Accessing KeyVault from Windows machines require certificates, but this is not feasible from Linux VMs in HDI which doesn't have support for certificate store. Does anyone solved similar problem?
During investigation, I came across this (https://docs.microsoft.com/en-us/azure/key-vault/tutorial-net-linux-virtual-machine). Didn't tried it myself, but my colleague said it didn't work for him. If it is possible to configure service identity on HDI worker nodes, I would love to hear. Thanks.1 vote -
Allow Keyvault purge when 'purge protection' is enabled
Purge protection is a required setting for our InfoSec team. Unfortunately we cannot move a keyvault from one region to another one, and we cannot completely get it purged (https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-soft-delete / https://docs.microsoft.com/en-us/rest/api/keyvault/vaults/purgedeleted).
There should be a mechanism/procedure to force a keyvault purge (even by raising an INC to MS)1 vote -
Support for Ed25519 SSH keys in Azure Key Vault
as per https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys
'Azure currently supports SSH protocol 2 (SSH-2) RSA public-private key pairs with a minimum length of 2048 bits. Other key formats such as ED25519 and ECDSA are not supported.'As ED25519 standard is more and more popular, also faster, more secure and supported out of the box on likes of Ubuntu and other platforms using latest OpenSSH it would be very handy addition.
2 votes -
I facing issue while settng / getting secret keys using Key Voult API. I am getting 501 response from these API's
I facing issue while settng / getting secret keys using Key Voult API. I am getting 501 response from these API's
1 vote -
include functions as a trusted service in key vault firewall exceptions
Include functions as a trusted service in key vault firewall exceptions. Why wouldn't you include all Azure services - unless we don't trust Azure PaaS anymore? ;-)
4 votesThanks for the valid suggestion. Your feedback is now open for the user community to up-vote & comment on. This allows us to effectively prioritize your request against our existing feature backlog and also gives us insight into the potential impact of implementing the suggested feature.
-
Improve PowerShell error messages
Hello,
I found an issue that when calling get-AzKeyVaultSecret from PS, it returns useless error "forbidden". When instead I call az keyvault secret show from Bash, i get error that "IP address *** not allowed".
PS Azure:\> Get-AzKeyVaultSecret -vaultname tbtest3-kv
Get-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At line:1 char:1
+ Get-AzKeyVaultSecret -vaultname tbtest3-kv
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Get-AzKeyVaultSecret], KeyVaultErrorException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.GetAzureKeyVaultSecrettomas@Azure:~$ az keyvault secret show --name "AppSecret" --vault-name "tbtest3-kv"
Client address (137.117.226.47) is not authorized and caller is not a trusted serviceThe IP restriction is intentional, but it appears so…
3 votes -
Key Vault Service Limits
The Key Vault limits are at a 10 second granularity but the granularity of its metrics are 1 minute. Please consider adjusting the limits to be in line with the granularity of the metrics available.
1 vote -
Snapshot Entire Vault for Backup and Restore
The current backup/restore solution for Keyvault keys, secrets and certs takes a lot of time to perform.
It would be great if you could snapshot a whole Keyvault and save the backup. This would allow restore to use that backup snapshot.3 votes -
Soft-Deleting KeyVault should release the Resource name
If I delete a KeyVault with "SoftDelete", it should be possible to create a new KeyVault with the same name.
An internal versioning logic should be able to distinguish between the versions.
1 vote -
Allow access to the public part of KEYS in KeyVault from ARM templates
It would be very useful to be able to generate a key and then get the public portion to pass to the appSettings for another App.
This is needed for secure deployments where some apps may be in different security 'zones' where they cannot have access to a shared key-vault.
Generating a key would be useful, especially if we could request that one be generated only if it does not already exist.
At the very least having access to the public portion of the key in the same way we have access to a secret would be very helpful:
"publicJsonKey"…
1 vote -
Add support for STORING the Storage Account Key in addition to rotating it.
Add support for STORING the Storage Account Key in addition to rotating it. Rotating the key is only part of the issue for us, the other half is making it available to application teams in a manner that doesn't require us to give them direct access to each and every storage account at the azure resource level. We prefer to give the team a key vault and store the keys in the kv, which makes it simple for the application team to reference it. When it is updated, we update the kv and that's that.
1 vote
- Don't see your idea?