3. Key Vault Credential¶

Confirm the data-plane path¶

In Cirro, follow the diagnostics VM to its system-assigned managed identity, then inspect the role assignments that apply at the Key Vault scope. Confirm that the identity has both of these data-plane roles on cocoamankv:

• Key Vault Certificate User
• Key Vault Secrets User

Request a token for the Azure Key Vault audience through the same authorized VM path used in the previous section. Verify that its tenant and object claims represent the VM managed identity before using it.

Enumerate vault objects¶

Use the instructor-provided Cirro Azure CLI extension while listing the vault's certificates and secrets. Confirm that the extension is active and note its database path:

az cirro status
az config get cirro.db_path

If the instructor directs you to create a separate artifact for this stage, set its path before running the Key Vault list commands:

az config set cirro.db_path=./key-vault-data.db

After the authorized list operations, check the captured row counts:

az cirro status
sqlite3 key-vault-data.db \
  "SELECT item_type, COUNT(*) FROM keyVaultItems GROUP BY item_type;"

Ingest key-vault-data.db with the same cirro graph ingest workflow used for the management-plane databases, then refresh CirroDash. Confirm that Key Vault item nodes now appear before beginning credential correlation.

The vault contains a large decoy population. Do not select a credential based on a convincing name, and do not download every secret value. Instead, correlate metadata from both planes:

1. Find the svc-global-reader application and service principal in the Entra evidence.
2. Confirm which tenant-wide directory role the service principal holds.
3. Inspect the application's certificate key credential.
4. Match its public key or thumbprint to one certificate in the vault.
5. Resolve that certificate to its same-named backing secret.

Create a CirroDash table card for the correlation query demonstrated by the instructor. Return the certificate name, public identifier or thumbprint, backing-secret name, and associated application in separate columns so the matching evidence is visible in one result.

Every Key Vault certificate with an exportable private key has a same-named secret containing its PKCS#12 material. Retrieve only the backing secret for the certificate you correlated to svc-global-reader.

Explain the graph extension¶

Your evidence should support a path with relationships equivalent to:

Managed Identity --HAS_DATA_PLANE_ROLE--> Key Vault
Key Vault --CONTAINS--> Certificate
Certificate --HAS_BACKING_SECRET--> Secret
Certificate --CREDENTIAL_FOR--> svc-global-reader