Backup/Restore Key Vault - Day 22 of #25DaysOfServerless - Winter Solstice: Protect Secrets from Grim Reaper!
Tags: 25daysofserverless, serverless, azure, dotnet
Published: 2019-12-23 00:10:19

---
title: Backup/Restore Key Vault - Day 22 of #25DaysOfServerless - Winter Solstice: Protect Secrets from Grim Reaper!
published: true
cover_image: https://thepracticaldev.s3.amazonaws.com/i/6z5dct67wfpfbxnmivht.jpg
description: This is the challenge for Day 22, as a part of 25 Days of Serverless, that implements an Azure Functions app to backup Azure Key Vault secrets to Azure Blob Storage and restore it from Azure Blob Storage to Azure Key Vault.
tags: 25daysofserverless, serverless, azure, dotnet
canonical_url: https://devkimchi.com/2019/12/23/25-days-of-serverless-day-22-winter-solstice-protect-secrets-from-grim-reaper/
---

This article is part of [#25DaysOfServerless][25dos]. New challenges will be published every day from Microsoft Cloud Advocates throughout the month of December. Find out more about how Microsoft Azure enables your [Serverless functions][az func index].

Have an idea or a solution? <a class="twitter-share-button" href="https://twitter.com/intent/tweet?text=I'm joining the @azureadvocates %2325DaysOfServerless challenge!! Learn more at https://aka.ms/25daysofserverless or see solutions at https://dev.to/search?q=25DaysOfServerless! Join me!" data-url="https://aka.ms/25daysofserverless' " data-hashtags="25DaysOfServerless"> Share your thoughts on Twitter! 
</a><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

---

## Challenge ##

Welcome to Korea in this festive season! Today is Winter Solstice, which means grim reapers are wandering around in search of young kids' souls to steal. But there's a way to keep the children safe: the reapers can't find any child who eats red-bean porridge before going to sleep!

![porridge][redbean porridge]

Oh no! Cheol-soo missed the porridge tonight, and is in danger to get caught by the grim reaper! His best friend Young-hee locked him in a safe place until sunrise, and stored the digital key to the smart lock in Azure Key Vault.

![memo][memo]

The grim reaper is annoyed that they're thwarted, though, and is trying to destroy the Key Vault to trap Cheol-soo in the safe room! Young-hee needs to figure out how to back up and restore the Key Vault before the Grim Reaper destroys it, or else Cheol-soo will be stuck in there forever!

Build a system that can back up and restore a secure key vault. If you're using Azure Key Vault, you may want to investigate Blob Storage restoration via Managed Identity.


## Prerequisites ##

### Azure Account ###

Do you have an Azure account yet? Let's create the one [free of charge][free az account]. As this free account is offered with USD 200, it would be more than enough to complete this challenge.


### Azure CLI ###

[Azure CLI][az cli] as a cross-platform tool helps manage Azure resources in a console terminal. Use [this link][az cli install] to install Azure CLI.


## Sample Solution Code ##

The sample solution used in this post can be found at [this GitHub repository][github repo].


## Resource Provisioning ##

In order to solve this challenge, first of all, you need to provision resources on Azure. Click the link below for provisioning.

[![Deploy to Azure](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazure.png)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fjustinyoo%2F25-days-of-serverless%2Fmaster%2Fweek-4%2Fchallenge-22%2Fsrc%2FResources%2Fazuredeploy.json)

If you prefer to using [Azure CLI][az cli], run the following command.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=az-group-deployment.sh %}

Once completed, you can find out all the resources correctly provisioned on Azure Portal.

![resource provisioning result][challenge 01]


## Azure Functions Managed Identity ##

In order to directly access Azure Key Vault from Azure Functions without performing explicit authentication/authorisation, check whether the `Managed Identity` feature is activated or not.

![managed identity][challenge 02]


## Azure Key Vault Access Policy ##

In order to manage secrets directly on the portal, with my account, the Access Policy needs to be updated. Go into the `Access policies` blade and click the `+ Add access policy` link.

![access poliocy blade][challenge 03]

Choose `Select all` for `Secret permissions`.

![secrets][challenge 04]

Enter your account name for `Select principal`.

![user][challenge 05]

Then click the `Add` button followed by the `Save` button on the screen. Now the Azure Key Vault instance allows my account for access.


## Secrets to Azure Key Vault ##

When Young-hee locked the door to hide Cheol-soo, she received a secret code.

> `DoYouKnow,soN,Bts,&pSy?`

We need to store it to the Azure Key Vault. Click the `Secrets` blade and the `+ Generate/Import` button.

![create secret][challenge 06]

Let's put `cheolsoo` into the `Name` field and the secret code into the `Value` field. Click the `Create` button at the bottom. Now, we've stored the secret into Azure Key Vault.

![secret created][challenge 07]


## Azure Function for Azure Key Vault Secret Backup ##

Here's the workflow to backup secrets from Azure Key Vault.

1. Get the list of secrets
2. Iterate the list and backup each secret individually
3. Create an array containing all the backup result
4. Serialise the array and upload it to [Azure Blob Storage][blob st]

Let's create the first workflow item &ndash; get the list of secrets. This method returns the list of secret names.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=secrets-get.cs %}

This method loops the list of secret names and backup each secret individually. At the time of this writing, as there is no bulk backup feature offered yet, we should run the loop. Once every secret is backed up, the method returns a list of backup results.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=secrets-backup.cs %}

This method serialises the backup results and uploads it to Azure Blob Storage. Spot on the backup filename of this format, `<yyyyMMdd>.json`.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=blob-upload.cs %}

Now, we've got all the workflow features. Let's create an HTTP trigger function and put the workflow inside.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=trigger-backup.cs %}

We're ready to run the HTTP trigger. Let's run this on our local development environment. In order to use the [Managed Identity][az func msi] feature on the local, we need to, first of all, [login to Azure][az cli kv] via [Azure CLI][az cli]. Once logged in, run the debugging mode on Visual Studio Code.

![debug backup][challenge 08]

Use [Postman][postman] to call the endpoint, and it will show the result.

![postman backup][challenge 09]

And this result can also be found on Azure Blob Storage.

![storage explorer backup][challenge 10]

We managed to help Young-hee backup Azure Key Vault before the grim reaper destroys it. Time is running out! Let's move on! The grim reaper is storming in!


## Azure Function for Azure Key Vault Secret Restore ##

Here's the workflow to backup secrets to Azure Key Vault.

1. Get the timestamp of the backup
2. Download backup from Azure Blob Storage with the timestamp
3. Deserialise the backup
4. Restore the backup to a new Azure Key Vault instance

We know the timestamp format, `yyyyMMdd`. It is passed through the URL of the HTTP trigger. This method downloads the backup with the timestamp and deserialises it to a list, and return the list.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=blob-download.cs %}

This method iterates the list of backup secrets, and each backup secret is restored individually within the loop. Similar to the backup, there is no bulk restore feature supported, at this time of the writing.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=secrets-restore.cs %}

Now, we got the whole workflow for restore. Let's create the HTTP trigger to run them all.

{% gist https://gist.github.com/justinyoo/f1081e1061d02396048acf162e3b52d9 file=trigger-restore.cs %}

We have the HTTP trigger for restore. Let's run it locally. With the debug mode of Visual Studio Code, calling the endpoint through [Postman][postman] shows the result.

![postman restore][challenge 11]

The new Azure Key Vault instance show the restored result.

![keyvault restore][challenge 12]

Phew! We got this! Young-hee has now been able to backup and restore Azure Key Vault. The grim reaper can no more take Cheol-soo, nor scrap the Key Vault. Soon the Sun is rising, the grim reaper must leave, and Young-hee can now go to sleep. So can you. We will see you tomorrow with another challenge!

---

Want to submit your solution to this challenge? Build a solution locally and then [submit an issue][github issue]. If your solution doesn't involve code, you can record a short video and submit it as a link in the issue description. Make sure to tell us which challenge the solution is for. We're excited to see what you build! Do you have comments or questions? Add them to the comments area below.

---

Watch for surprises all during December as we celebrate 25 Days of Serverless. Stay tuned here on dev.to as we feature challenges and solutions! Sign up for a [free account on Azure][free az account] to get ready for the challenges!

[redbean porridge]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/red-bean-porridge.png
[memo]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/memo.png
[challenge 01]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-01.png
[challenge 02]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-02.png
[challenge 03]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-03.png
[challenge 04]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-04.png
[challenge 05]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-05.png
[challenge 06]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-06.png
[challenge 07]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-07.png
[challenge 08]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-08.png
[challenge 09]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-09.png
[challenge 10]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-10.png
[challenge 11]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-11.png
[challenge 12]: https://sa0blogs.blob.core.windows.net/devkimchi/2019/12/challenge-12.png

[25dos]: https://25daysofserverless.com

[free az account]: https://azure.microsoft.com/free/?WT.mc_id=25days_devto-blog-cxa

[github issue]: https://github.com/microsoft/25-days-of-serverless/issues/new?assignees=&labels=challenge-submission&template=challenge-solution-submission.md&title=%5BCHALLENGE+SUBMISSION%5D+
[github repo]: https://github.com/justinyoo/25-days-of-serverless

[az func index]: https://docs.microsoft.com/azure/azure-functions/?WT.mc_id=25days_devto-blog-cxa
[az func msi]: https://docs.microsoft.com/azure/app-service/overview-managed-identity?tabs=dotnet&WT.mc_id=25days_devto-blog-cxa

[az cli]: https://docs.microsoft.com/cli/azure/get-started-with-azure-cli?view=azure-cli-latest&WT.mc_id=25days_devto-blog-cxa
[az cli install]: https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest&WT.mc_id=25days_devto-blog-cxa
[az cli kv]: https://docs.microsoft.com/samples/azure-samples/app-service-msi-keyvault-dotnet/keyvault-msi-appservice-sample/?WT.mc_id=25days_devto-blog-cxa#step-5-run-the-application-on-your-local-development-machine

[postman]: https://getpostman.com/

[blob st]: https://docs.microsoft.com/azure/storage/blobs/storage-blobs-introduction?WT.mc_id=25days_devto-blog-cxa