Key rotation concepts in Azure - Mini Project: Build & Apply

Key Rotation Concepts in Azure Key Vault

📖 Scenario: You manage secrets and keys in Azure Key Vault for a small company. To keep data safe, you need to rotate keys regularly. This means creating new keys and updating your system to use them without downtime.

🎯 Goal: Build a simple Azure Key Vault key rotation setup using Azure CLI commands in a script. You will create a key, set a rotation policy, and simulate rotating the key.

📋 What You'll Learn

Create an Azure Key Vault named myKeyVault

Create a key named myKey in the vault

Set a key rotation policy to rotate every 30 days

Simulate rotating the key by creating a new version

💡 Why This Matters

🌍 Real World

Key rotation is essential to keep encryption keys secure and reduce risk of compromise in cloud environments.

💼 Career

Cloud engineers and security professionals regularly manage key rotation policies to maintain compliance and security.

1

Create Azure Key Vault

Write the Azure CLI command to create a Key Vault named myKeyVault in the resource group myResourceGroup located in eastus.

Azure

# Your Azure CLI command here to create the Key Vault

Hint

Use az keyvault create with --name, --resource-group, and --location options.

2

Create a Key in the Vault

Write the Azure CLI command to create a key named myKey in the Key Vault myKeyVault.

Azure

az keyvault create --name myKeyVault --resource-group myResourceGroup --location eastus
# Your Azure CLI command here to create the key

Hint

Use az keyvault key create with --vault-name and --name options.

3

Set Key Rotation Policy

Write the Azure CLI command to set a key rotation policy on myKey in myKeyVault to rotate every 30 days.

Azure

az keyvault create --name myKeyVault --resource-group myResourceGroup --location eastus
az keyvault key create --vault-name myKeyVault --name myKey
# Your Azure CLI command here to set the rotation policy

Hint

Use az keyvault key rotation-policy update with --expiry-time and --rotation-frequency set to P30D.

4

Rotate the Key by Creating a New Version

Write the Azure CLI command to create a new version of the key myKey in myKeyVault to simulate key rotation.

Azure

az keyvault create --name myKeyVault --resource-group myResourceGroup --location eastus
az keyvault key create --vault-name myKeyVault --name myKey
az keyvault key rotation-policy update --vault-name myKeyVault --name myKey --expiry-time P30D --rotation-frequency P30D
# Your Azure CLI command here to create a new key version

Hint

Run az keyvault key create again with the same key name to create a new version.

Practice

1. What is the main purpose of key rotation in Azure Key Vault?

easy

A. To share keys with other users

B. To delete all keys after use

C. To backup keys to local storage

D. To regularly change keys to improve security

Solution

1. Step 1: Understand key rotation purpose

   Key rotation means changing keys regularly to reduce risk if keys are exposed.

2. Step 2: Identify correct purpose in options

   Only To regularly change keys to improve security describes improving security by changing keys regularly.

3. Final Answer:

   To regularly change keys to improve security -> Option D

4. Quick Check:

   Key rotation = improve security by changing keys regularly [OK]

Hint: Key rotation means changing keys often for safety [OK]

Common Mistakes:

• Thinking key rotation deletes keys
• Confusing key rotation with key sharing
• Believing key rotation backs up keys

2. Which Azure CLI command is used to rotate a key in Azure Key Vault?

easy

A. az keyvault key create

B. az keyvault key update

C. az keyvault key rotate

D. az keyvault key delete

Solution

1. Step 1: Recall Azure CLI commands for key management

   To rotate a key, you create a new version using 'az keyvault key create'.

2. Step 2: Match command to rotation action

   'az keyvault key rotate' does not exist; 'create' is correct for rotation.

3. Final Answer:

   az keyvault key create -> Option A

4. Quick Check:

   Rotate key = create new version command [OK]

Hint: Use 'create' command to rotate keys in Azure CLI [OK]

Common Mistakes:

• Using 'update' instead of 'create' for rotation
• Assuming 'rotate' is a valid CLI command
• Confusing 'delete' with rotation

3. Given this Azure CLI command sequence:

az keyvault key create --vault-name MyVault --name MyKey --protection software
az keyvault key update --vault-name MyVault --name MyKey --ops encrypt decrypt sign verify

What is the expected result after running these commands?

medium

A. The key MyKey is deleted from MyVault

B. A new key named MyKey is created and its operations are updated

C. The key MyKey is backed up locally

D. An error occurs because update cannot change operations

Solution

1. Step 1: Analyze the create command

   The first command creates a key named MyKey in MyVault with software protection.

2. Step 2: Analyze the update command

   The update command changes the key's allowed operations to encrypt, decrypt, sign, and verify.

3. Final Answer:

   A new key named MyKey is created and its operations are updated -> Option B

4. Quick Check:

   Create then update key operations = success [OK]

Hint: Create key first, then update operations to rotate [OK]

Common Mistakes:

• Thinking update deletes the key
• Assuming update backs up the key
• Believing update cannot change operations

4. You try to rotate a key using this command:

az keyvault key rotate --vault-name MyVault --name MyKey

But you get an error saying the command is not found. What is the likely cause?

medium

A. The 'rotate' command does not exist in Azure CLI for keys

B. The vault name is incorrect

C. The key name is missing

D. You need to delete the key before rotating

Solution

1. Step 1: Check Azure CLI command availability

   Azure CLI does not have a 'key rotate' command for Key Vault keys.

2. Step 2: Identify correct rotation method

   Rotation is done by creating a new version or updating the key, not by a rotate command.

3. Final Answer:

   The 'rotate' command does not exist in Azure CLI for keys -> Option A

4. Quick Check:

   No 'rotate' command in Azure CLI keys [OK]

Hint: No 'rotate' command; use update or create new version [OK]

Common Mistakes:

• Assuming 'rotate' command exists
• Blaming vault or key name for syntax errors
• Trying to delete key before rotation

5. You want to automate key rotation in Azure Key Vault without downtime. Which approach is best?

hard

A. Export keys locally and re-import after rotation

B. Delete the old key and create a new key with the same name immediately

C. Create a new key version and update applications to use it before deleting old key

D. Manually update keys once a year during maintenance windows

Solution

1. Step 1: Understand zero downtime rotation

   Creating a new key version allows apps to switch smoothly without service interruption.

2. Step 2: Evaluate options for automation and safety

   Deleting keys immediately causes downtime; manual yearly updates risk security; exporting keys is insecure.

3. Final Answer:

   Create a new key version and update applications to use it before deleting old key -> Option C

4. Quick Check:

   New version + update apps = smooth rotation [OK]

Hint: Use new key version and switch apps before deleting old key [OK]

Common Mistakes:

• Deleting old key before switching
• Relying on manual yearly rotation
• Exporting keys outside Key Vault