2022-02-08 19:01:19 +00:00
|
|
|
---
|
|
|
|
|
layout: docs
|
|
|
|
|
page_title: Managed Keys
|
|
|
|
|
description: >-
|
|
|
|
|
Managed Keys is a system in Vault that defers all private key operations to a third party system.
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Managed Keys
|
|
|
|
|
|
2022-04-05 14:54:35 +00:00
|
|
|
|
2022-02-08 19:01:19 +00:00
|
|
|
Within certain environments, customers want to leverage key management systems
|
|
|
|
|
external to Vault, when handling, storing, and interacting with
|
|
|
|
|
private key material, or are required to do so by standards requirements.
|
|
|
|
|
|
2022-04-05 14:54:35 +00:00
|
|
|
To satisfy these requirements, Vault has a centralized abstraction called
|
|
|
|
|
*Managed Keys* that different secrets engines can plug into, allowing them to
|
|
|
|
|
delegate these operations to a trusted external KMS.
|
|
|
|
|
|
|
|
|
|
Minimally, a managed key consists of a named managed key entry managed by the
|
|
|
|
|
[`sys/managed-key`](../../api-docs/system/managed-keys) API. Besides a name,
|
|
|
|
|
there are backend specific configurations to access the key in question.
|
|
|
|
|
|
|
|
|
|
For PKCS#11 (HSM) backed managed keys, the managed key configuration must
|
|
|
|
|
reference a [kms library stanza](../configuration/kms-library) which points
|
|
|
|
|
to a PKCS#11 access library on the host machine.
|
|
|
|
|
|
|
|
|
|
Note that a configured, named managed key corresponds to a single key within
|
|
|
|
|
a backend. More than one managed key can be configured targetting a single
|
|
|
|
|
backend by creating multiple managed keys with the API.
|
2022-02-08 19:01:19 +00:00
|
|
|
|
|
|
|
|
## Namespace support
|
|
|
|
|
|
|
|
|
|
Every configured Managed Key is bound to a given namespace, defaulting to the
|
|
|
|
|
root namespace. Any secrets engine's mount path must exist within the same namespace
|
|
|
|
|
as the Managed Key for which it intends to use.
|
|
|
|
|
|
|
|
|
|
## Backend Support
|
|
|
|
|
|
2022-03-07 20:22:42 +00:00
|
|
|
Managed Keys were developed to support different types of external backends. At
|
|
|
|
|
this time supported backends are PKCS#11, AWS KMS and Azure Key Vault.
|
|
|
|
|
Support for additional integrations may be added in the future.
|
2022-02-08 19:01:19 +00:00
|
|
|
|
2022-04-05 14:54:35 +00:00
|
|
|
## Secret and Auth Engine Support
|
2022-02-08 19:01:19 +00:00
|
|
|
|
2022-03-18 01:14:48 +00:00
|
|
|
The [PKI Secrets Engine](/api-docs/secret/pki#managed-keys) has been integrated
|
2022-02-08 19:01:19 +00:00
|
|
|
with Managed Keys to offer certificate generation, both root and intermediary
|
|
|
|
|
PKI paths, leveraging private keys from an external trusted KMS.
|
|
|
|
|
|
2022-04-05 14:54:35 +00:00
|
|
|
More engines may leverage managed keys in the future.
|
|
|
|
|
|
2022-02-08 19:01:19 +00:00
|
|
|
## API
|
|
|
|
|
|
|
|
|
|
Managed Keys can be managed over the HTTP API. Please see
|
|
|
|
|
[Managed Keys API](/api-docs/system/managed-keys) for more details.
|
|
|
|
|
|
|
|
|
|
To configure PKI secrets engine with Managed Keys please see
|
2022-03-18 01:14:48 +00:00
|
|
|
[PKI Secret API](/api-docs/secret/pki#managed-keys)
|
