Azure Key Vault

Create an Azure servicePrincipal in your Azure AD Tenant
Use AZ CLI to create a servicePrincipal and obtain the json credential file.

Authenticate to your Azure tenant.

$ az login

Create a servicePrincipal

$ az ad sp create-for-rbac

Save the resulting json output.+

{
  "appId": "xxxxxxxx-xxxxx-xxxx-xxxxxxxx",
  "displayName": "azure-cli-2018-11-01-xx-xx-xx",
  "name": "http://azure-cli-2018-11-01-xx-xx-xx",
  "password": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "tenant": "xxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

In the Azure Key Vault, add the servicePrincipal to the

Access Policies

with the following permissions:

secrets/get permission
secrets/list permission
In the Prisma Cloud Console, go to
Manage > Authentication > Secrets
.
Click
Add store
.
Enter a name for the vault. This name is used when you create rules to inject secrets into specific containers.
For
Type
, select
Azure Key Vault
.
For
Address
, enter
https://<vault-name>.vault.azure.net
. This address can be found in the Azure Key Vault’s properties in the DNS Name element.
In
Credential
, click
Add new
.
If you create a credential in the credentials store (
Manage > Authentication > Credentials store
), your service principal authenticates with a password. To authenticate with a certificate, create a cloud account.
Enter a name for the credentials.
In
Type
, select
Azure
.
In
Service Key
, enter the JSON credentials returned from the az ad sp create-for-rbac command.
Click
Save
.
Click
Add
.
After adding the new store, Prisma Cloud tries conecting to your vault. If it is successful, the dialog closes, and an entry is added to the table. Otherwise, any connection errors are displayed directly in the configuration dialog.
Next, inject a secret into a container.