Azure Key Vault: secrets, certificates, soft delete

1Create a vault with RBAC and give yourself access

Vault names are global, so add a random suffix. Then assign yourself Key Vault Administrator on the vault:

$sfx = Get-Random -Minimum 10000 -Maximum 99999
$kv = "kv-saat-$sfx"
az group create --name rg-saat-l55 --location centralindia --tags course=saatvedha-azure lesson=55 -o none
az keyvault create --resource-group rg-saat-l55 --name $kv --location centralindia --enable-rbac-authorization true --retention-days 7 --tags course=saatvedha-azure lesson=55 -o none
$kvId = az keyvault show --name $kv --query id -o tsv
$me = az ad signed-in-user show --query id -o tsv
az role assignment create --assignee-object-id $me --assignee-principal-type User --role "Key Vault Administrator" --scope $kvId -o none

Creating the vault made you its owner on the management plane, but with RBAC that doesn’t include reading or writing secrets. The data role does. Role assignments can take a minute or two to apply.

2Store a password and a certificate

Generate a random password, store it, and create a self-signed certificate from the default policy:

$pw = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 20 | ForEach-Object { [char]$_ })
az keyvault secret set --vault-name $kv --name db-password --value $pw --query name -o tsv
az keyvault certificate get-default-policy | Out-File -Encoding ascii C:\azure-lab\certpolicy.json
az keyvault certificate create --vault-name $kv --name web-cert --policy '@C:\azure-lab\certpolicy.json' -o none
az keyvault certificate show --vault-name $kv --name web-cert --query "{subject:policy.x509CertificateProperties.subject, expires:attributes.expires}" -o table

You should see something like this:

db-password
Subject                Expires
---------------------  -------------------------
CN=CLIGetDefaultPolicy 2027-10-21T09:14:02+00:00

A real certificate would come from a certificate authority linked to the vault, with a policy that renews it automatically before it expires.

3A VM with a managed identity

Create a small VM with a system-assigned identity, and give that identity read access to one secret only:

az vm create --resource-group rg-saat-l55 --name vm-kv --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --public-ip-sku Standard --nsg-rule NONE --assign-identity --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=55 -o none
$vmId = az vm show --resource-group rg-saat-l55 --name vm-kv --query identity.principalId -o tsv
az role assignment create --assignee-object-id $vmId --assignee-principal-type ServicePrincipal --role "Key Vault Secrets User" --scope "$kvId/secrets/db-password" -o none

The VM has a public IP only so it can reach the vault’s public endpoint; no inbound port is open. In production you’d use a private endpoint, as in Lesson 26.

4Read the secret from the VM

Save this script as C:\azure-lab\read-secret.sh. KVNAME and SECRETNAME are filled in before each run:

#!/bin/bash
# Read one Key Vault secret with the VM's managed identity (no passwords on the VM)
TOKEN=$(curl -s -H Metadata:true 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net' | python3 -c 'import sys,json; print(json.load(sys.stdin)["access_token"])')
curl -s -H "Authorization: Bearer $TOKEN" 'https://KVNAME.vault.azure.net/secrets/SECRETNAME?api-version=7.4' | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("value") or d["error"]["code"] + " / " + d["error"]["innererror"]["code"])'

Run it for db-password (wait a couple of minutes after the role assignment):

(Get-Content C:\azure-lab\read-secret.sh -Raw) -replace 'KVNAME', $kv -replace 'SECRETNAME', 'db-password' | Set-Content C:\azure-lab\read-now.sh
az vm run-command invoke --resource-group rg-saat-l55 --name vm-kv --command-id RunShellScript --scripts '@C:\azure-lab\read-now.sh' --query "value[0].message" -o tsv

You should see something like this (your password is different):

Enable succeeded:
[stdout]
Qm7Rt2KpX9aLw4ZsN8vB

[stderr]

The value matches $pw. The VM proved who it was with a token, not with a password.

✅ Checkpoint: The vault uses RBAC, holds db-password and web-cert, and vm-kv reads db-password with its managed identity.