Copying Credentials from CyberArk to Azure Key Vault

A detailed guide for selective safe migration with unencrypted credentials

Highlights

Selective Safe Migration: Step-by-step instructions to specifically target desired safes in CyberArk.
Unencrypted Credentials: Methods to ensure credentials become available in plain text form after migration.
Automation and Security: Guidance on using PowerShell and plugin setups, incorporating best practices for security.

Overview

Migrating credentials securely from CyberArk to Azure Key Vault while targeting only specific safes is a process that requires a methodical configuration of both systems. As organizations seek to centralize secret management, they often need to restrict operations to certain safes in CyberArk—either because not all secrets need migration or due to regulatory reasons. This guide outlines the necessary steps, tools, and considerations for copying credentials from selected CyberArk safes directly into Azure Key Vault with the requirement that the credentials remain unencrypted after retrieval.

Prerequisites and Initial Considerations

Before starting the migration process, ensure that you have the required access and tools installed. The following prerequisites must be met:

Access and Permissions

To successfully migrate credentials, you will need:

Appropriate CyberArk permissions to access and view the credentials in the desired safes.
An Azure Active Directory (AD) or Active Directory (AD) account with the necessary permissions to create, update, and manage secrets in Azure Key Vault.

Software and Tools

It is important to have the following tools installed and configured:

Azure Az PowerShell Module – This module is used to interact with Azure services from the command line.
CyberArk PrivateArk Client – This client manages safes, policies, and account details within CyberArk.
Third-Party Plugin (Optional) – Numerous GitHub repositories provide a solution for synchronizing passwords between CyberArk and Azure Key Vault using a CPM plugin.

Understanding Credential Handling

Normally, Azure Key Vault is designed to store secrets in an encrypted format at rest. However, if the requirement is to have credentials available in a non-encrypted, plain text form upon retrieval, you must ensure that:

The transfer process does not re-encrypt data when pushing it to Azure Key Vault.
Any subsequent retrieval or integration to your application handles the credentials appropriately.

Configuring CyberArk for Selective Safe Migration

The first phase of the process involves configuring your CyberArk environment to allow for a selective export from specific safes. Follow these steps:

1. Identify the Specific Safes

Determine which safes contain the credentials that need migrating. Create a list of these safes along with the specific accounts or secrets. This focused approach minimizes impact and reduces the overhead associated with a full Vault migration.

2. Update CyberArk Policies and Usage Options

CyberArk’s configuration relies on its set of policies, particularly defined via an XML policies file (commonly the Policies.xml from the PVWAConfig Safe). The following modifications are essential:

Add New File Categories: Create two new TEXT type file categories in the PrivateArk client named “KeyVaultName” and “SecretName”. This will facilitate the mapping of each secret to its corresponding Key Vault entry.
Modify Policies File: Update Policies.xml to include a new usage, typically referred to as “Update-AzKV”. You will add the necessary XML code for this new service account platform. Ensure that the attribute for “SearchForUsage” is enabled (set to “Yes”), which allows for automatic updates after a password change.

3. Associate Logon Accounts

Once CyberArk’s configuration is updated, ensure that the specific accounts you intend to migrate are associated with an appropriate logon account—typically an Azure AD or AD account. This account must have the necessary permissions to interact with and update secrets in the Azure Key Vault.

Migrating Credentials Using a CPM Plugin and Scripts

For automated transfers from CyberArk to Azure Key Vault, a repeated, streamlined process can be performed via a CPM plugin or custom PowerShell scripting. Both methods are effective, and the choice depends on your organization’s deployment environment and policy.

Option 1: Using a CPM Plugin

For the automation enthusiasts, a third-party CPM plugin is available on public repositories that can be customized to fetch and update credentials from selected safes in CyberArk to Azure Key Vault. The general steps in this option include:

Using the PrivateArk client, incorporate the new “Update-AzKV” usage for each account in the identified safes.
Verify that the Policy file (Policies.xml) has been updated with new XML code to support the integration.
Test the synchronization process by clicking the change or update button for one of the accounts. Once confirmed, any subsequent password change in CyberArk will automatically trigger an update to the Azure Key Vault.

Option 2: Manual Migration via PowerShell Scripting

Alternatively, you can automate the process using PowerShell scripts that selectively retrieve credentials from CyberArk and push them into Azure Key Vault. This method provides granular control and the ability to filter actions by safe.

PowerShell Script Details

Below is an example PowerShell command snippet that demonstrates the transfer process:


# Install the Azure Az PowerShell Module (if not already installed)
Install-Module -Name Az -Force

# Import the module into the current session
Import-Module Az

# Connect to your Azure account
Connect-AzAccount

# Replace with your actual secret value fetched from CyberArk
$secretValue = "YourPlaintextSecret" 

# Set the Azure Key Vault secret without encryption by converting the value to a secure string as plain text
Set-AzKeyVaultSecret -VaultName "YourVaultName" -Name "YourSecretName" -SecretValue (ConvertTo-SecureString $secretValue -AsPlainText -Force)

# Retrieve and verify the secret from Azure Key Vault (for verification purposes)
Get-AzKeyVaultSecret -VaultName "YourVaultName" -Name "YourSecretName"

In this script:

$secretValue: This variable should be populated with the actual credential string taken from CyberArk.
Set-AzKeyVaultSecret: This command uploads the secret into your Azure Key Vault. By converting the string using ConvertTo-SecureString with the parameters -AsPlainText -Force, you ensure that the credential is stored in a plain text format for downstream operations.
Testing: Using the Get-AzKeyVaultSecret command helps in verifying that the credentials have been copied over properly.

Filtering by Specific Safes

Whether you choose the plugin or a scripted approach, the key lies in targeting specific safes. For a script:

Parse a list or array of safe identifiers that need to be processed.
For each safe, retrieve accounts matching your criteria.
Execute the credential push/update operation only for those accounts.

By incorporating logic into your script to filter for only the desired safe names or IDs, you ensure that sensitive migration tasks are applied selectively.

Configuring Azure Key Vault

After configuring CyberArk and establishing a migration script or plugin, the next phase is ensuring that Azure Key Vault is properly set up to receive and store your credentials.

Setting Up Azure Key Vault

If you have not created an Azure Key Vault yet, do so by following these steps:

Log in to the Azure Portal and create a new Key Vault instance.
In the Key Vault’s settings, navigate to the Access Policies section.
Grant set, get, list, and if necessary, delete permissions to the Azure AD/AD account that will be used for updating secrets.

Ensuring Unencrypted Credential Handling

Despite Azure Key Vault’s inherent encryption at rest, this process focuses on ensuring that when credentials are retrieved, they are presented in an unencrypted or plain text form. Here are key points to consider:

In-Transit Security: Ensure that all communication between CyberArk, your migration scripts, and Azure Key Vault is secured using TLS or other secure communication protocols.
Post-Retrieval Processing: Once credentials are retrieved via API or PowerShell, manage them appropriately in your application environment to prevent exposure to unauthorized parties.
Access Controls: Enforce strict access policies both in CyberArk and Azure Key Vault to limit who can trigger these operations.

Monitoring and Maintenance

With the migration set up, daily operations, and subsequent migrations require diligent monitoring. Security is paramount when handling unencrypted credentials.

Automation and Scheduled Tasks

Whether you are leveraging CPM plugins or PowerShell scripts, it is recommended to:

Automate the migration process through scheduled tasks or CI/CD pipelines to ensure credentials are updated regularly.
Review logs and alerts both in CyberArk and Azure to monitor the status and integrity of the migration process.

Periodic Audit and Update

Schedule regular audits of your configurations and security permissions to make sure:

The newly created usage configurations in CyberArk remain aligned with current security practices.
Access for the Azure AD/AD account is appropriate and limited strictly to what is necessary.
Any changes in organizational policies are promptly reflected in your migration scripts or plugin configurations.

HTML Table: Migration Process Overview

Step	Action	Key Considerations
1	Identify Specific Safes	List only the safes/accounts to be migrated
2	Update CyberArk Policy (Policies.xml)	Add new file categories and define Update-AzKV usage
3	Configure Logon Account	Grant permission in CyberArk and Azure Key Vault
4	Migrate Using Plugin/Script	Utilize PowerShell or CPM plugins for automation
5	Set Up Azure Key Vault	Configure access policies and permissions
6	Monitor and Audit	Automate logs, reviews, and periodic updates

Security Considerations

Storing credentials unencrypted once they are retrieved involves security trade-offs that need to be carefully managed. Even though Azure Key Vault encrypts secrets at rest, it is essential to recognize that once credentials are exported or processed, they may be exposed to risk if not handled with the proper measures.

Risk Management

Some security practices to consider include:

Strict Access Controls: Ensure that only authorized personnel have the ability to trigger migration tasks and access both systems. Implement role-based access control (RBAC) in both CyberArk and Azure.
Encryption in Transit: Always secure data transfers using TLS or similar protocols so that credentials are protected during migration.
Audit Logging: Enable and review audit logs in both CyberArk and Azure Key Vault to track who is performing migration actions and when.

Post-Processing Security

Consider how your application or environment will handle these credentials once retrieved from the Vault:

If credentials need to be used in applications, ensure that memory management and logging practices do not inadvertently expose them.
For additional security, consider wrapping temporary plain text credentials in a secure middleware that provides extra authorization layers.