Secrets Management

To prepare for a production environment, replace Hashicorp Vault* with a secrets management provider.

To replace secrets management, update these services:

• MPS
• RPS

What You'll Do¶

This guide focuses on updating the secrets management with Azure Key Vault*.

Here are the main tasks:

• Review Vault Schema
• Add Secret Provider Dependency (if necessary)
• Update Configuration
• Implement the Code

Review Vault Schema¶

Below are the paths/keys in the vault that are used by the Open AMT Cloud Toolkit.

# RPS
CIRAConfigs/[cira_config_name]/MPS_PASSWORD

certs/[domain_profile_name]/CERT
certs/[domain_profile_name]/CERT_PASSWORD

profiles/[profile_name]/AMT_PASSWORD
profiles/[profile_name]/MEBX_PASSWORD

wireless/[wireless_profile_name]/PSK_PASSPHRASE

# MPS
devices/[device_guid]/AMT_PASSWORD
devices/[device_guid]/MEBX_PASSWORD
devices/[device_guid]/MPS_PASSWORD

Add Dependency¶

To install the required dependencies:

Open a Terminal or Command Prompt and navigate to a directory of your choice for development:

npm install @azure/keyvault-secrets

npm install @azure/identity

Update Configuration¶

To modify the configuration:

1. Modify the properties for Hashicorp Vault:

   Before:

   {
      "secrets_path": "secret/data/",
      "vault_address": "http://localhost:8200",
      "vault_token": "myroot",
   }
   

   After:

   For Azure Key Vault, you only need the address:

   {
      "secrets_path": "",
      "vault_address": "https://<YOUR KEYVAULT NAME>.vault.azure.net",
      "vault_token": "",
   }
   

2. Set these three ENV variables:

   AZURE_TENANT_ID=<YOUR-TENANT-ID>
   AZURE_CLIENT_ID=<YOUR-CLIENT-ID>
   AZURE_CLIENT_SECRET=<YOUR-CLIENT-SECRET>
   

Implement the Code¶

To support secrets management:

1. Consider the exported interface ISecretManagerService.

   export interface ISecretManagerService 
   {
     getSecretFromKey: (path: string, key: string) => Promise<string>
     getSecretAtPath: (path: string) => Promise<any>
     listSecretsAtPath: (path: string) => Promise<any>
     readJsonFromKey: (path: string, key: string) => Promise<string>
     writeSecretWithKey: (path: string, key: string, keyvalue: any) => Promise<void>
     writeSecretWithObject: (path: string, data: any) => Promise<void>
     deleteSecretWithPath: (path: string) => Promise<void>
   }
   

2. This example focuses on getSecretFromKey, set up and implemented below:

     const { DefaultAzureCredential } = require("@azure/identity")
     const { SecretClient } = require("@azure/keyvault-secrets")
   
     export class AzureSecretManagerService implements ISecretManagerService 
     {
          vaultClient: SecretClient
          logger: ILogger
   
          constructor (logger: ILogger) 
          {
             // DefaultAzureCredential expects the following three environment variables:
             // * AZURE_TENANT_ID: The tenant ID in Azure Active Directory
             // * AZURE_CLIENT_ID: The application (client) ID registered in the AAD tenant
             // * AZURE_CLIENT_SECRET: The client secret for the registered application
             const credential = new DefaultAzureCredential()
   
             // Lastly, create our secrets client and connect to the service
             const client = new SecretClient(EnvReader.GlobalEnvConfig.VaultConfig.address, credential);
          }
   
          async getSecretFromKey (path: string, key: string): Promise<string> 
          {
             try
             {
              this.logger.verbose(`getting secret from vault: ${path}, ${key}`)
               const latestSecret = await client.getSecret(key);
               this.logger.debug(`got data back from vault: ${path}, ${key}`)
               return latestSecret
             } 
             catch (error) 
             {
               this.logger.error('getSecretFromKey error \r\n')
               this.logger.error(error)
               return null
             }
          }
     }
   

   The example above is for one interface. You'll need to implement each interface defined in ISecretManagerService.

3. After all the functions have been implemented, finish up by instantiating the AzureSecretManagerService in the src/Configurator.ts file.

     constructor()
     {
      //existing
      //this.secretsManager = new SecretManagerService(new Logger('SecretManagerService'))
      //new implementation
      this.secretsManager = new AzureSecretManagerService(new Logger('AzureSecretManagerService'))
     }