Multi-Cloud Sync (PRO + ENTERPRISE)¶

Sync replicates Azure Key Vault secrets and certificates to AWS and GCP for disaster recovery and multi-cloud deployments.

For AWS and Google Cloud, keyless sign-in lets you sync without storing provider keys. The setup below also supports stored keys.

Overview¶

Sync enables multi-cloud credential management:

• Azure to AWS: Secrets Manager, ACM
• Azure to GCP: Secret Manager, Certificate Manager
• Scheduled sync: Automatic synchronisation on schedule
• Copies after a rotation: A rotation updates its copies straight away. See Copies after a rotation
• Manual trigger: On-demand sync for immediate updates
• Exclusion rules: Skip specific secrets from sync
• Conflict detection: Handle version conflicts gracefully

Supported Targets¶

AWS¶

GCP¶

Each Secret Manager copy keeps its current and previous version. Older versions are destroyed, so Google Cloud stops charging for them.

How Sync Works¶

Sync Flow¶

Azure Key Vault                    Target Cloud
┌─────────────────┐                ┌─────────────────┐
│ kv-production   │                │ AWS Secrets Mgr │
│                 │                │                 │
│ ├── api-key ────┼────Sync────────│──► api-key      │
│ ├── db-conn ────┼────Sync────────│──► db-conn      │
│ └── cert-tls ───┼────Sync────────│──► ACM cert     │
└─────────────────┘                └─────────────────┘

What Gets Synced¶

What Doesn't Get Synced¶

• Version history (only current version)
• Access policies
• Azure-specific metadata
• Key Vault keys (only secrets/certs)

Provider Configuration¶

AWS Configuration¶

Create IAM User¶

Replace <REGION> with the region you will enter in CertifyClouds and <ACCOUNT_ID> with your AWS account ID.

# Create IAM policy
aws iam create-policy \
  --policy-name cc-sync-policy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "SecretCopies",
        "Effect": "Allow",
        "Action": [
          "secretsmanager:CreateSecret",
          "secretsmanager:UpdateSecret",
          "secretsmanager:PutSecretValue",
          "secretsmanager:DescribeSecret",
          "secretsmanager:TagResource",
          "secretsmanager:DeleteSecret"
        ],
        "Resource": "arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:*"
      },
      {
        "Sid": "CertificateCopies",
        "Effect": "Allow",
        "Action": [
          "acm:ImportCertificate",
          "acm:AddTagsToCertificate",
          "acm:DeleteCertificate"
        ],
        "Resource": "arn:aws:acm:<REGION>:<ACCOUNT_ID>:certificate/*"
      }
    ]
  }'

# Create IAM user
aws iam create-user --user-name cc-sync-user

# Attach policy
aws iam attach-user-policy \
  --user-name cc-sync-user \
  --policy-arn arn:aws:iam::<ACCOUNT_ID>:policy/cc-sync-policy

# Create access key
aws iam create-access-key --user-name cc-sync-user

What each permission is for:

• Create, update, describe and tag secrets: write each secret copy and check whether it is already up to date.
• Import and tag certificates: write each certificate copy to Certificate Manager (ACM). A certificate ACM will not accept, such as an expired one, is stored in Secrets Manager instead, so certificates need the secret permissions too.
• Delete secrets and certificates: remove a copy when you remove it from the sync queue, if Delete from AWS when removed from sync queue is on. A deleted secret can be restored for 30 days.

No other permissions are needed. CertifyClouds never reads secret values back from AWS, and copies use your account's default Secrets Manager encryption key, so no KMS permissions are needed. If you sync only secrets, you can leave out the CertificateCopies statement.

A copy has the same name as its Azure item unless you give it a different Target Name. To limit the secret permissions to certain names, give every copy a Target Name that starts with the same prefix, such as certifyclouds/, and change secret:* to secret:certifyclouds/*. Certificates cannot be limited this way: AWS gives each imported certificate a random ID, so the certificate permissions can only be limited to your account and region.

Configure in CertifyClouds¶

1. Go to Settings → Cloud Providers and select AWS
2. Enter:
3. AWS Access Key ID
4. AWS Secret Access Key
5. AWS Region (e.g., us-east-1)
6. Click Save Configuration
7. Click Test Connection to confirm the key signs in to AWS; the permissions above are only checked by the first sync

Editing this page needs an admin account.

GCP Configuration¶

Create Service Account¶

# Turn on the two services sync writes to
gcloud services enable secretmanager.googleapis.com certificatemanager.googleapis.com \
  --project=PROJECT_ID

# Create service account
gcloud iam service-accounts create cc-sync-sa \
  --display-name="CertifyClouds Sync"

# Create, update and delete secret copies
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:cc-sync-sa@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.editor"

# Create, update and delete certificate copies
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:cc-sync-sa@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/certificatemanager.owner"

# Create key
gcloud iam service-accounts keys create key.json \
  --iam-account=cc-sync-sa@PROJECT_ID.iam.gserviceaccount.com

What each role is for:

• Secret Manager Editor (roles/secretmanager.editor): create, update and label each secret copy, destroy versions older than the previous one, and delete the copy when you remove it from the sync queue. It cannot read secret values. A certificate that Certificate Manager will not accept is stored in Secret Manager instead, so certificates need this role too.
• Certificate Manager Owner (roles/certificatemanager.owner): create, update and delete certificate copies. Certificate Manager Editor is not enough, because it cannot delete a certificate.

If you sync only secrets, you can leave out the Certificate Manager role. Certificate Manager Owner also lets the account change certificate maps, DNS authorisations and trust configs in the project; for a tighter grant, create a custom role with only certificatemanager.certs.create, certificatemanager.certs.get, certificatemanager.certs.list, certificatemanager.certs.update, certificatemanager.certs.delete and certificatemanager.operations.get, and grant it instead.

Configure in CertifyClouds¶

1. Go to Settings → Cloud Providers and select GCP
2. Enter your GCP Project ID and region
3. Paste the service account JSON key into Service Account JSON Key
4. Click Save Configuration
5. Click Test Connection to confirm the key signs in to Google Cloud; the roles above are only checked by the first sync

Editing this page needs an admin account.

Creating Sync Records¶

From the UI¶

1. Go to Automation and open the Replication & Sync tab. The Queue view lists every copy.
2. Click Add to sync queue. The Add assets to sync queue window opens. Adding assets needs an admin account.
3. Find the secrets or certificates to copy with the search box or the vault filter, then tick each one. Assets already in the queue are not listed.
4. Choose the destination with the AWS and GCP switch. A cloud is greyed out until you have set it up under Settings → Cloud Providers.
5. Click Add to Queue, which shows how many assets you ticked. Each asset joins the queue with automatic sync on and a 24-hour interval. The window stays open, so you can add more.

You do not choose a target service. Secrets go to Secrets Manager (AWS) or Secret Manager (GCP), and certificates to Certificate Manager.

To give a copy a different name, or to change how often it is checked, open the More actions menu on its row, choose Edit configuration, change Target Name or Sync Interval (hours), and click Save Changes.

Naming¶

A copy has the same name as the Azure item, unless you give it a Target Name.

Sync Scheduling¶

Automatic Sync¶

Configure sync to run on a schedule:

Each sync runs on the interval set on its configuration, or on demand with Sync now. Interval runs need scheduled sync switched on. An admin turns it on with the Scheduled sync switch on the Replication & Sync page, or with Cloud sync in Settings → Advanced → Workers; both control the same thing. While it is off, the page shows Scheduled sync is off: rotations still update copies, but changes made directly in Azure are not copied until you run a sync.

Manual Sync¶

Trigger sync immediately:

1. Go to Automation and open the Replication & Sync tab
2. Select sync records
3. Click Sync now
4. Monitor progress

Copies after a rotation¶

When a rotation changes a secret or certificate that CertifyClouds copies to AWS, Google Cloud or another Key Vault, CertifyClouds updates the copy straight away instead of waiting for the next scheduled sync. A rollback updates the copies the same way. This happens even while scheduled sync is off.

The switch is Update this copy right after a rotation, on by default. Only admins can change it:

• AWS and Google Cloud copies: Settings → Cloud Providers, select the provider, under Sync Settings
• Key Vault replications: the Replication behaviour action on the replication's row in the sync queue

With it off, the next scheduled sync copies the new value.

The rotation's run page shows each copy and whether it has the new value; see Copies on the run page. If an update fails, run Sync now on the copy, or let the next scheduled sync copy it.

The old credential is kept until the copies have the new value, up to a limit (72 hours after the rotation by default), unless an admin retires it early with Retire now. See Waiting for copies.

Sync Status¶

Status Indicators¶

Sync History¶

View sync history for each record:

1. Click on sync record
2. View History tab
3. See:
4. Timestamp
5. Status
6. Duration
7. Any errors

Conflicts¶

There is no conflict-strategy setting. Conflicts are handled by Key Vault to Key Vault replication, which blocks the first write to a target that already holds an item of the same name until someone acknowledges it. See Replication for the behaviour and the acknowledge action.

Exclusions¶

Exclusions stop a secret being synced even when it matches a sync configuration. They are managed in the app, not in Settings, and only an admin can change them. Everyone else sees the list read-only.

Add an exclusion¶

1. Go to Automation → Replication & Sync → Exclusions
2. Click Add Exclusion
3. Choose a Match Type: Contains, Starts with, Ends with, Exact match or Regex
4. Enter the Pattern it matches against the secret name, for example test-
5. Optionally enter a Vault Name to limit the rule to one vault. Leave it empty and the rule applies to every vault
6. Optionally enter a Reason so the next person knows why it is there
7. Click Add Exclusion at the bottom of the form

There is no tag-based exclusion. Patterns match the secret name, not Azure tags.

Common Exclusions¶

• Development/test secrets
• Secrets with personal data
• Secrets only used in Azure
• Deprecated secrets

Security¶

Credential Storage¶

AWS/GCP credentials are stored securely:

• Encrypted at rest using industry-standard symmetric encryption
• Never logged or exposed in API responses

Data in Transit¶

All sync operations use TLS:

• Azure to CertifyClouds: TLS 1.2+
• CertifyClouds to AWS: TLS 1.2+ (AWS SDK)
• CertifyClouds to GCP: TLS 1.2+ (GCP SDK)

Audit Trail¶

All sync operations are logged:

• Who initiated (user or system)
• What was synced
• To where
• Success/failure status

API access¶

Sync endpoints are listed in API Endpoints; exact request and response shapes are in your deployment's /docs.

Troubleshooting¶

"AWS credentials invalid"¶

Cause: Access key/secret incorrect or expired.

Fix: - Verify credentials in AWS IAM console - Create new access key if needed - Check IAM policy permissions

"Permission denied on target"¶

Cause: IAM policy doesn't allow the operation.

Fix: - Compare the IAM policy or Google Cloud roles with Provider Configuration - Check the policy's resource names match the copy's name and region - Ensure correct region is configured

"Secret not found in source"¶

Cause: Source secret was deleted or moved.

Fix: - Run a Key Vault scan (Assets › Scan) to refresh the secret list - Update sync record with new source - Delete orphaned sync records

"Sync timeout"¶

Cause: Network or rate limiting issues.

Fix: - Check network connectivity to AWS/GCP - Reduce concurrent sync operations - Retry with exponential backoff

Best Practices¶

1. Use prefixes: Add certifyclouds/ prefix to identify synced secrets
2. Limit scope: Only sync secrets that need multi-cloud access
3. Monitor sync status: Set up alerts for failed syncs
4. Regular audits: Review sync records quarterly
5. Secure credentials: Rotate AWS/GCP credentials periodically
6. Test DR: Regularly verify synced secrets work in target cloud