Store MySQL Enterprise encryption key in Azure Key Vault

user_1329758 0
Viewed 353

MySQL Server Enterprise edition integrates with Hashicorp to encrypt data at rest. The encryption key is stored in HashiCorp vault as described in MySQL documentation.

Based on HashiCorp documentation [1] [2], we can use Azure Key Vault to store secrets.

Is it possible to integrate MySQL - HashiCorp - Azure Key Vault so

  • MySQL Enterprise Edition is encrypted using HashiCorp
  • The encryption key is stored in AKV.

Edit with more details: I am already saving and reading the MySQL encryption key in the kv(Hashicop) vault. But I want to configure to read and store this key from the Azure Key Vault.

Configuring the MySQL server with something like this:

[mysqld]

early-plugin-load=keyring_hashicorp.so

keyring_hashicorp_role_id='XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX'

keyring_hashicorp_secret_id='XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX'
keyring_hashicorp_store_path='/azure/mysql'

In Azure, I have set up

vault read azure/creds/my-role
Key                Value
---                -----
lease_id           azure/creds/my-role/XXXXXXXX
lease_duration     1h
lease_renewable    true
client_id          XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX
client_secret      XXXXXXXX

How can I set up keyring_hashicorp_store_path to get the key from Azure?

I cannot find any configuration option, tutorials or documentation to make the three works together.

azure-keyvault hashicorp-vault mysql
1 Answers

Yes it's possible. I assume you mean storing some unseal keys for HashiCorp Vault, used to unseal the vault when you need access to keys...and where you want to store those unseal keys in yet another vault like Azure Key Vault? As with any Key Vault, you can pretty much store whatever keys, values, even small text docs in some, that you want up to the limits of a vault's maximum safe encryption range (see the docs on each service's individual provided crytographic key store, or ask their support)

It's important to note that the HashiCorp plugin for MySQL says this as well:

After these AppRole role ID and secret ID credentials are generated, they are expected to remain valid indefinitely. They need not be generated again and the keyring_hashicorp plugin can be configured with them for use on an ongoing basis. For more information about AuthRole authentication, visit https://www.vaultproject.io/docs/auth/approle.html.

user_11007170
Related