Add HSM support to Key Vault

[p3ck]

SUMMARY

Add support for HSM in KeyVault module(s)

ISSUE TYPE

• Feature Pull Request
• New Module Pull Request

COMPONENT NAME

plugins/modules/azure_rm_keyvault.py
plugins/modules/azure_rm_keyvault_info.py
plugins/modules/azure_rm_keyvaultsecuritydomain.py

ADDITIONAL INFORMATION

The vendored_sdks is copied directiy from azure-cli. It doesn't seem to be packaged in the azure-python-sdk which is where I think it should go.

[p3ck]

@Fred-sun or @xuzhang3 Can one of you run the integration tests? I've tested as much as my account allows me but I don't have permission to download the security domain file in my org.

az keyvault security-domain download --id https://hsm34330be106.managedhsm.azure.net --security-domain-file "sd_file_name" --sd-quorum 2 --sd-wrapping-keys ./files/cert_0.cer ./files/cert_1.cer ./files/cert_2.cer 
(AccessDenied) Not authorized to perform Security Domain backup. (Activity ID: 8d56a47c-7756-11ef-a729-6045bd7b4c47)

I've also had limited success running this in the pipeline, I either get 5 HSM's are already deployed or a gateway timeout.

ansible-test integration azure_rm_keyvault --allow-destructive

Thanks.

[xuzhang3]

p3ck

sure, I will running these tests.

[xuzhang3]

@p3ck can you help migrate the vendor-sdk to azure-keyvault-administration for KV HSM management?

https://learn.microsoft.com/en-us/python/api/overview/azure/keyvault-administration-readme?view=azure-python

[xuzhang3]

@p3ck test failed: https://dev.azure.com/azclitools/public/_build/results?buildId=191631&view=logs&j=76c949d7-ae3c-5dab-f3c6-f88fb1d3b538&t=8d517798-7997-54bb-f3b0-245ccd1cc734

[p3ck]

I've looked at this and it doesn't seem to have the methods to actually setup the HSM for use. Please see this: https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/quick-create-cli The piece that is missing is the security-domain download.

…

On Mon, Sep 23, 2024 at 2:11 AM xuzhang3 ***@***.***> wrote: @p3ck <https://github.com/p3ck> can you help migrate the vendor-sdk to azure-keyvault-administration for KV HSM management? https://learn.microsoft.com/en-us/python/api/overview/azure/keyvault-administration-readme?view=azure-python — Reply to this email directly, view it on GitHub <#1717 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAUPZOCU44OVGE3RPAU6WRDZX6WJ3AVCNFSM6AAAAABOMFWUM6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNRXGMYDMMRQHA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[p3ck]

I have been able to test some of this locally..

TASK [azure_rm_keyvault : Lookup service principal object id] ******************                                       
ok: [testhost]                                                                                                         
                                                                                                                       
TASK [azure_rm_keyvault : Create instance of HSM -- check mode] ****************                                       
changed: [testhost]                                                                                                    
                                                                                                                       
TASK [azure_rm_keyvault : Assert the resource instance is well created] ********                                       
ok: [testhost] => {                                                                                                    
    "changed": false,                                                                                                  
    "msg": "All assertions passed"                                                                                     
}                                                                                                                      
                                                                                                                       
TASK [azure_rm_keyvault : Create instance of HSM] ******************************                                       
changed: [testhost]                                                                                                    
                                                                                                                       
TASK [azure_rm_keyvault : Assert the resource instance is well created] ********                                       
ok: [testhost] => {                                                                                                    
    "changed": false,                                                                                                  
    "msg": "All assertions passed"                                                                                     
}                                                                                                                      
                                                                                                                       
TASK [azure_rm_keyvault : Create instance of HSM again] ************************                                       
ok: [testhost]                                                                    

                                                                                                                       
TASK [azure_rm_keyvault : Assert the state has not changed] ********************                                       
ok: [testhost] => {                                                                                                    
    "changed": false,                                                                                                  
    "msg": "All assertions passed"                                                                                     
}                                                                                                                      

TASK [azure_rm_keyvault : Update existing HSM (add tags)] **********************
changed: [testhost]

TASK [azure_rm_keyvault : Assert the state has changed] ************************
ok: [testhost] => {
    "changed": false,
    "msg": "All assertions passed"
}

TASK [azure_rm_keyvault : Get hsm facts] ***************************************
ok: [testhost]

TASK [azure_rm_keyvault : Assert the facts are properly set] *******************
ok: [testhost] => {
    "changed": false,
    "msg": "All assertions passed"
}

TASK [azure_rm_keyvault : Download the security domain file] *******************
ok: [testhost]

TASK [azure_rm_keyvault : Save the security domain file] ***********************
ok: [testhost] => {
    "output[\"security_domain\"]": {
        "EncData": {
            "data": [
                {
                    "compact_jwe": "eyJhbGci
....
                }
            ],
            "key_algorithm": "shamir_share",
            "required": 2
        },
        "version": 2
    }
}

TASK [azure_rm_keyvault : Create a hsm key] ************************************
fatal: [testhost]: FAILED! => {"changed": false, "msg": "Find the key vault secret got exception, exception as (AccessDenied) Not authorized to access Microsoft.KeyVault/managedHsm/keys/read/action on '/keys' (Activity ID: 86f8b88c-7cdc-1
1ef-b688-6045bdb636b6)\nCode: AccessDenied\nMessage: Not authorized to access Microsoft.KeyVault/managedHsm/keys/read/action on '/keys' (Activity ID: 86f8b88c-7cdc-11ef-b688-6045bdb636b6)"}

TASK [azure_rm_keyvault : Delete the hsm key] **********************************
fatal: [testhost]: FAILED! => {"changed": false, "msg": "Find the key vault secret got exception, exception as (AccessDenied) Not authorized to access Microsoft.KeyVault/managedHsm/keys/read/action on '/keys' (Activity ID: 8940f78a-7cdc-1
1ef-a902-6045bd7b46a8)\nCode: AccessDenied\nMessage: Not authorized to access Microsoft.KeyVault/managedHsm/keys/read/action on '/keys' (Activity ID: 8940f78a-7cdc-11ef-a902-6045bd7b46a8)"}

As you can see I was able to download the security-domain which involves uploading the public certs and specifying the minimum number for quorum.

I am unable to test the key generation since I don't have permission to do that. I don't think my account has the correct permissions from my org since I tried the following as well:

az keyvault role assignment create --hsm-name hsm34330be702 --role "Managed HSM Crypto User" --assignee-object-id ca413070-9a06-4e0a-8bb8-c167d29fa09e  --scope /keys
(AccessDenied) Not authorized to access Microsoft.KeyVault/managedHsm/roleDefinitions/read/action on /keys (Activity ID: 54356da2-7b7c-11ef-8b0b-6045bdb636b6)
Code: AccessDenied
Message: Not authorized to access Microsoft.KeyVault/managedHsm/roleDefinitions/read/action on /keys (Activity ID: 54356da2-7b7c-11ef-8b0b-6045bdb636b6)

I've also opened an issue in the azure-cli package asking if the vendored_sdks files can be broken out into a separate package.

Azure/azure-cli#29998

[p3ck]

Waiting for Azure/azure-sdk-for-python#37929 to finalize so we can use the SDK.

[Fred-sun]

@p3ck Please help solve the conflict, and push forward the merger after the test after the relevant PR release in April. Thank you!

[p3ck]

This has been updated to use the new python-sdk, azure-keyvault-securitydomain==1.0.0b1

[xuzhang3]

@p3ck
Sanity test fail:

ERROR: Found 1 validate-modules issue(s) which need to be resolved:
ERROR: plugins/modules/azure_rm_keyvault_info.py:0:0: parameter-type-not-in-doc: Argument 'hsm_name' in argument_spec defines type as 'str' but documentation doesn't define type

[Fred-sun]

Creating and deleting keys prompts authorization issues. I'm still reading. Thank you!

[p3ck]

Creating and deleting keys prompts authorization issues. I'm still reading. Thank you!

I don't actually have an account with enough permissions to test the creation of the HSM keys. I am able to create the HSM keyvault with the security domain. but I'm not able to create the HSM keys even with the azure cli command. I tried adding the correct permissions via the web interface but I still don't know which role is needed.

[Fred-sun]

@p3ck Your changes themselves are fine and can be merged directly. But our test would also be added to the pipeline cycle task. Because the SPN of the periodic task has no access permission. The MSH Vault Key creation will failed. So it is suggested to delete or annotate the tests related to the MSH Vault key (lines 567 to 654). This way, it can be merged into the repo more quickly.Thank you!

[p3ck]

I've updated the test cases to remove the MSH test cases for now. The tests run to completion for me now.