Fivetran External Secret Management with Azure Key Vault Setup Guide

Follow our setup guide to connect your Azure Key Vault to Fivetran to use it as an External Secret Manager.

Prerequisites

To connect your Azure Key Vault to Fivetran, you need the following:

An Azure account with permissions to manage Azure Key Vault
An Azure Key Vault with the Azure role-based access control (RBAC) permission model enabled
A Fivetran account with the Account Administrator role

Fivetran only supports the Azure RBAC permission model for Key Vault. The vault access policy model is not supported. Learn how to check or change your Key Vault's permission model.

Setup instructions

Select the tab for your deployment model:

Find your Tenant ID

Log in to the Azure portal.
On the navigation menu, select Microsoft Entra ID (formerly Azure Active Directory).
Make a note of the Tenant ID. You will need it to configure Fivetran.

Find your Vault URL

Navigate to your Key Vault in the Azure portal.
On the Overview page, make a note of the Vault URI. You will need it to configure Fivetran.

Grant Fivetran access to your Key Vault

In your Key Vault, click Access Control (IAM) on the navigation menu.
Click Add > Add role assignment.
On the Role tab, select Key Vault Secrets User and click Next.
On the Members tab, set Assign access to to User, group, or service principal.
Click + Select members.
Search for Fivetran and select the Fivetran application from the list.
Click Select, then click Review + assign.
Review the assignment and click Review + assign to confirm.

Configure External Secret Manager in Fivetran

In the Fivetran dashboard, go to Account Settings > General > External Secrets Managers.
Click Create new secrets manager.
Select SaaS Deployment and Azure Key Vault.
Provide the following:
- Secret Manager Name: An internal name for this secrets manager in Fivetran.
- Vault URL: The Vault URI you noted earlier.
- Tenant ID: The Tenant ID you noted earlier.
Click Add secrets manager.

Find your Vault URL

Log in to the Azure portal and navigate to your Key Vault.
On the Overview page, make a note of the Vault URI. You will need it to configure Fivetran.

Grant your HD agent access to the Key Vault

Follow the instructions for the environment where your HD agent is running:

Your HD agent uses Microsoft Entra Workload ID to authenticate to your Key Vault with a dedicated managed identity.

Enable Workload ID on your AKS cluster

AKS Automatic clusters have OIDC issuer and Workload ID enabled by default. If you use an AKS Automatic cluster, skip to Find the OIDC issuer URL.

In the Azure portal, navigate to your AKS cluster.
On the navigation menu, select Settings > Security configuration.
Enable OIDC issuer and Workload Identity.
Click Save.

Find the OIDC issuer URL

In the Azure portal, click the Cloud Shell icon in the top bar and select Bash.

Run the following command. Replace <cluster-name> and <resource-group> with the name and resource group of your AKS cluster:

az aks show --name <cluster-name> --resource-group <resource-group> --query "oidcIssuerProfile.issuerUrl" --output tsv

Make a note of the URL in the command output. You will need it to create a federated credential.

Create a managed identity

In the Azure portal, navigate to Managed Identities.
Click + Create.
On the Basics tab, provide the following:
- Subscription: The subscription for the managed identity.
- Resource group: The resource group for the managed identity.
- Region: The region for the managed identity.
- Name: A name for the managed identity, for example, fivetran-hd.
Click Review + create, then click Create.
When the deployment completes, click Go to resource.
On the Overview page, make a note of the Client ID. You will need it to configure your HD agent.

Grant the managed identity access to the Key Vault

Navigate to your Key Vault.
Click Access Control (IAM) on the navigation menu.
Click Add > Add role assignment.
On the Role tab, select Key Vault Secrets User and click Next.
On the Members tab, set Assign access to to Managed identity.
Click + Select members.
In the Managed identity drop-down menu, select User-assigned managed identity.
Find and select the managed identity you created.
Click Select, then click Review + assign.
Review the assignment and click Review + assign to confirm.

Create a federated credential

Navigate to the managed identity you created.
On the navigation menu, select Settings > Federated credentials.
Click + Add Credential.
In the Federated credential scenario drop-down menu, select Kubernetes accessing Azure resources.
Provide the following:
- Cluster Issuer URL: The OIDC issuer URL you noted earlier.
- Namespace: The Kubernetes namespace your HD agent runs in.
- Service Account: hd-job-sa
- Name: A name for the federated credential, for example, fivetran-hd-job.
Keep the default Audience value, api://AzureADTokenExchange.
Click Add.

Configure your HD agent

Log in to the environment where kubectl and Helm are configured to connect to your AKS cluster.
Run the following command to set the azure_workload_identity_client_id parameter to the Client ID you noted earlier. The --reset-then-reuse-values option keeps the values you set when you installed the agent, so you don't need to provide them again. This option requires Helm 3.14 or later.
```
helm upgrade hd-agent \
  oci://us-docker.pkg.dev/prod-eng-fivetran-ldp/public-docker-us/helm/hybrid-deployment-agent \
  --namespace <namespace> \
  --reset-then-reuse-values \
  --set config.azure_workload_identity_client_id=<client-id> \
  --version <helm-chart-version>
```

Restart the HD agent to apply the change:

kubectl rollout restart deployment/hd-agent -n <namespace>

If your Key Vault restricts public network access, make sure your AKS cluster can reach it, for example through a virtual network rule for the cluster's node subnet or a private endpoint. For more information, see Microsoft's documentation.

Navigate to your Key Vault.
Click Access Control (IAM) on the navigation menu.
Click Add > Add role assignment.
On the Role tab, select Key Vault Secrets User and click Next.
On the Members tab, set Assign access to to Managed identity.
Click + Select members.
In the Managed identity drop-down menu, select Virtual machine.
Find and select the virtual machine running your HD agent.
Click Select, then click Review + assign.
Review the assignment and click Review + assign to confirm.

Configure External Secret Manager in Fivetran

In the Fivetran dashboard, go to Account Settings > General > External Secrets Managers.
Click Create new secrets manager.
Select Hybrid Deployment and Azure Key Vault.
Provide the following:
- Secret Manager Name: An internal name for this secrets manager in Fivetran.
- Vault URL: The Vault URI you noted earlier.
Click Add secrets manager.

Creating secrets in Azure Key Vault

Once your External Secret Manager is configured, you can create secrets in your Azure Key Vault by navigating to Objects > Secrets and clicking Generate/Import. Azure Key Vault has no specific format requirements for secret values.

When setting up a connection or destination that uses ESM, enter the secret name (as shown in Azure Key Vault) in the corresponding ESM key field in Fivetran.