Generate dynamic passwords with Azure Key Vault for Postgresql Database running in Azure VM

M, Anbazhagan 20

Hey guys,

I have my open source postgresql deployed in Azure VMs. I would like to generate dynamic passwords for the database users using Azure Key Vault. Is it typically possible? If yes, can you please help down with steps or redirect me to right documentation?

M, Anbazhagan 20 Reputation points

2024-05-25T22:45:34.48+00:00

Hi @Vinodh247-1375 , Thanks for your initial reply. But in the example that you have shown it looks like we are hardcoding Or storing the password in the vault. My need was like vault should rotate the password after defined frequency and generate a dynamic connection string to connect to postgresql. Thanks in advance! Wanted to check primarily whether that's feasible.
Vinodh247-1375 12,421 Reputation points

2024-05-26T05:36:38.9266667+00:00
Hi @Vinodh247-1375 , Thanks for your initial reply. But in the example that you have shown it looks like we are hardcoding Or storing the password in the vault. My need was like vault should rotate the password after defined frequency and generate a dynamic connection string to connect to postgresql. Thanks in advance! Wanted to check primarily whether that's feasible.

M, Anbazhagan:

Try this and let me know.

For key rotation policy in key-vault:

https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

To retrieve secrets from Azure Key Vault and use them in Azure Postgresql:

After adding the secret to the key vault...

for getting the current version of the secret you can use the following URL format: https://<your-unique-keyvault-name>.vault.azure.net/secrets/examplepassword

To view the secret value as plain text:

using azure cli: az keyvault secret show --name "examplepassword" --vault-name "<your-unique-keyvault-name>" --query "value"

using azure powershell: $secret = Get-AzKeyVaultSecret -VaultName "<your-unique-keyvault-name>" -Name "examplepassword" -AsPlainText

using the secret in azure postgresql:

When creating an Azure PostgreSQL server, pass the secret value as the --admin-password parameter:

az postgres server create --resource-group "<your-resource-group>" --name "<your-server-name>" --location "<your-location>" --admin-user "<your-admin-user>" --admin-password "$secret" Note: Replace <your-resource-group>, <your-server-name>, <your-location>, <your-admin-user>, and $secret with appropriate values.

https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets#retrieve-a-secret
M, Anbazhagan 20 Reputation points

2024-05-27T03:58:32.3366667+00:00

Hi @Vinodh247-1375 ,

In nutshell, we can do rotation of passwords and generate passwords dynamically with hashicorp vault only and azure keyvault can't do the same? Just trying to confirm the same.

We are bit aware with hashicorp vault that it has capability to meet our need, but was in thought whether azure key vault can do the same?
Vinodh247-1375 12,421 Reputation points

2024-05-27T07:31:22.56+00:00

M, Anbazhagan: I have edited my comment and added more details, can you check on that and let me know if this helped.

Accepted answer

Michael Cameron 502 Reputation points

2024-05-27T10:50:53.6633333+00:00

In the past I have used a random password generation function to do this using inline powershell in ARM/bicep templates and/or scripts then storing those in keyvaults. I am not aware of any means of doing this solely with keyvault.

Hope this helps
Please sign in to rate this answer.

1 person found this answer helpful.
M, Anbazhagan 20 Reputation points

2024-05-27T10:54:22.02+00:00

Thanks Michael Cameron , I just felt Azure Key Vault was capable of doing something similiar to what Hashicorp vault does with password storing and regenerating.
Sign in to comment

1 additional answer

Vinodh247-1375 12,421

Hi M, Anbazhagan,

Thanks for reaching out to Microsoft Q&A.

after creating a secret in your Azure Key Vault that contains the password, you can try this...

To Retrieve the secret value

secret_value=$(az keyvault secret show --name AdminPassWord --vault-name <your-keyvault-name> --query value -o tsv)

Creating the PostgreSQL server

--az postgres server create \

--location <location> \

--resource-group <resource-group-name> \

--name <PostgresServerName> \

--admin-user <AdminUserName> \

--admin-password "$secret_value" \

--sku-name <pgSkuName>
```Alternatively, you can use the terraform to generate a password dynamically and store it in Azure Key Vault.

[https://blog.posedio.com/blog/postgres-database-crednetials-with-hashicorp-vault](https://blog.posedio.com/blog/postgres-database-crednetials-with-hashicorp-vault)

Please 'Upvote'(Thumbs-up) and 'Accept' as an answer if the reply was helpful. This will benefit other community members who face the same issue.

Share via

Generate dynamic passwords with Azure Key Vault for Postgresql Database running in Azure VM

1 additional answer