Extensions run code as root, outside the Vault's controls

Azure VM extensions are downloaded from the Azure control plane and run on the VM as the root user. Some extensions are designed to run any command (Run Command, Custom Script) or to reset accounts and SSH keys (VMAccess, used by the Azure Reset password option). On a key manager, code that runs as root can reach key material and configuration directly. It bypasses the Vault's own access controls, roles and audit log, and nothing it does is recorded by Vault.

Any Azure user with permission to write extensions or run commands on the Appliance VM would gain this access, even though that user is not a Vault administrator.

The appliance protects its own integrity

Vault restricts which programs may run on the appliance and continuously checks its system files for unexpected changes. Software that installs an extension is reported as tampering to the appliance and reverted by restoring and rebooting the appliance. Supporting extensions would mean weakening the controls that make the appliance trustworthy and violating the design principles of Vault.

Key access is tied to the appliance and its configuration

Vault binds access to its keys to the virtual machine it runs on. Agents that change the network configuration, host name, devices or disk layout can change what the appliance recognizes as itself. This can cause alerts, or prevent the Vault from unlocking its keys when it starts.

Access recovery belongs to Vault, not to Azure

Vault administrators regain access with the Vault admin key and the Vault recovery procedures. The private SSH key that you supply when you create the VM cannot be reset, even with the Azure Reset password option. An extension that resets accounts or keys would be a second, unaudited way into the appliance, which a key manager must not have.

Validated releases and upgrades

Every Vault release is built, tested and validated as a whole: the operating system, its packages and the Vault software. Extensions and agents install and update their own software outside that process. They can be removed or broken by a Vault upgrade, can cause an upgrade to fail, and leave the appliance in an unvalidated state.

Vault does not need them

Vault does not use Azure VM extensions for any of its functions. Deployment, clustering, monitoring, backup and upgrades are all provided by the Vault itself, as described below.

Monitoring and alerting (for example Azure Monitor Agent or Log Analytics)

• Send Vault audit and system messages to your syslog server or SIEM. To use Azure Monitor or Microsoft Sentinel, send them to a separate log-forwarder VM that runs the Azure agent.
• Use Vault SNMP traps and email alerts.
• Poll the Vault REST API for cluster status and version from your monitoring tool.

Endpoint detection and response, antimalware

Vault restricts which programs may run and monitors its own system files. Forward the Vault audit log and alerts to your SIEM for detection and response.

Vulnerability management (scanner agents)

Scan the Vault from the network. Entrust publishes security advisories and delivers fixes as Vault upgrades and patches.

Operating system patching (for example Azure Update Manager or automatic guest patching)

Apply Entrust upgrades and patches with System Upgrade in the Vault webGUI. They update the operating system and the Vault together, as a validated set.

Backup (for example the Azure Backup extension)

Use Vault backups and keep the admin key safe. For high availability, run a cluster with nodes in different regions.

Configuration and automation (Custom Script, Run Command)

Use the Vault REST API and webGUI, which apply roles and record every change in the audit log. Use the System Console (htadmin) for network and NTP settings.

Account and SSH key reset (VMAccess, Azure Reset password)

Use the Vault admin key and the Vault recovery procedures. Keep the private SSH key used when the VM was created in a safe place.

Disk encryption (Azure Disk Encryption, customer-managed disk encryption sets)

Vault encrypts its own data and must provide its keys when it starts. Azure always encrypts disks at rest with platform-managed keys.

Collecting diagnostics for support

Download a log bundle from the Vault webGUI or API.