Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?
I understand that this might be impossible as the code we have on Azure needs the key to validate incoming XML and sign outgoing XML and therefore that code has it. But I'm asking in the hope that there's a way to stop any individual from getting it.
I ask because I've learned over the years that occasionally someone you thought could be totally trusted, can't be.
Azure has a feature specifically for this Azure key vault These are backed by HSMs - this is what you want. You need to assign access to the application via serviceprincipals and the usual authentication / authorisation but this is how you want to be storing keys for applications within Azure.
"With Key Vault, Microsoft doesn’t see or extract your keys."
This is a somewhat broad question and is really more of an architectural and philosophical problem. Looking for a particular product is often a bad idea on this site, so I will offer some advice.
How do you define "no one else"? Code in the app, other apps on the VM, apps in other VMs, attackers hitting your web site, apps on the VM host, data center administrators, etc.? This will scope the design of the system.
Since we're talking keys, the short and simple design is to move access to and usage of the key out of the realm of those attacking it (helpful answer, right?).
Moving outward:
At each step you introduce boundaries and make it harder to get access to the keys. Those boundaries exist as authenticated services of some sort. Generally you hand the work off to these services and they touch the keys, that way your app doesn't.
The trade off is complexity and manageability for effective level of security.
If I understand you correctly, "no one else" means in your case "not my team" (so persons with access to source code, servers etc.).
So I see only two solutions:
Option A:
Option B:
Restrict access to your current server/service.
