Automatically Deploy the Vault using Azure Resource Manager
This section outlines the steps to automatically deploy the CyberArk Vault using Azure
Resource Manager (ARM). By leveraging ARM templates, you can automate the creation
of resources and ensure consistent, scalable deployment for your CyberArk Vault
infrastructure in Azure.
For the reference, please find the below link:
https://docs.cyberark.com/pam-self-hosted/14.2/en/content/pas%20cloud/azure-automaticdeployvault.htm?tocpath=Installer%7CInstall%20PAM%C2%A0in%20a%20cloud%20environment%7CInstall%
20the%20Digital%20Vault%20on%20the%20cloud%7C_____7
1. Import the CyberArk Components to Azure Container
➢
➢
./import-pas-images.ps1 -release "v14.2.0" -location "Region" -storageName
"cyberarkpasimage" -containerName "cyberarkpasimage" -resourceGroupName "CyberarkImages" https://md-g33tpfznjgdp.z11.blob.storage.azure.net/szzdwx5jbz1z/abcd?sv=2018-0328&sr=b&si=c33915ee-a4f6-47ea-9452ccafa360add7&sig=CpUs3ywgxbPPa%2BGptdm77AoteHG2ki165fL6n0E3yFI%3D"
Add License and recpub.key to the same container
2. Automatically Create the CyberArk Network Environment
You can create the CyberArk network environment for automatically deploying the PAM - SelfHosted solution on Azure using a pre-prepared ARM template. Run the template using either the
Azure Resource Manager UI or a Command Line Interface (CLI).
The template creates the following components:
Virtual Networks CyberArk PAM - Self-Hosted solution.
Private subnets in the Virtual Network.
Security Groups for each CyberArk component.
CyberArk Full Network Configuration
Name
Description
Default
Subscription
Select the Azure subscription to use for deploying the
solution
Resource Group
Either use an existing resource group or create a new one
for the deployment
Region
Select the region where you deploy the solution
PAS VNET CIDR
IPv4 address range for the PAM - Self-Hosted VNET
10.0.0.0/16
Vault Subnet CIDR
IPv4 address range for the Vault subnet
10.0.1.0/24
PVWA Subnet CIDR
IPv4 address range for the PVWA subnet
10.0.2.0/24
CPM Subnet CIDR
IPv4 address range for the CPM subnet
10.0.3.0/24
PSM Subnet CIDR
IPv4 address range for the PSM subnet
10.0.4.0/24
PSMP Subnet CIDR
IPv4 address range for the PSM for SSH subnet
10.0.5.0/24
PTA Subnet CIDR
IPv4 address range for the PTA subnet
10.0.6.0/24
Users Access CIDR
Allowed IPv4 address range for users access to CyberArk
components
Administrative
Access CIDR
Allowed IPv4 address range for Remote Desktop
administrative access to CyberArk instances
3. Run the Vault and DR templates
Run the template using either the ARM UI or a Command Line Interface (CLI).
The Azure ARM templates can be found in the public GitHub repository at the following link:
https://github.com/cyberark/pas-on-cloud/tree/master/azure
In the ARM template, specify the following information:
Vault template
Name
Description
Subscription
Select the Azure subscription to use for deploying
the solution
Resource Group
Either use an existing resource group or create a
new one for the deployment
Region
Select the region where you deploy the solution
Default
General parameters
License Agreement
I have read and agree to the Terms and Conditions
Key Vault Name
Enter the name of the Key Vault
Decline
Key Vault Name must be
unique. To avoid deployment
failure, validate in advance that
your Key Vault Name is
available. For details, see Vaults
- Check Name Availability.
Storage Account
Name
Enter the name of the storage account that contains
the license and public key
Container Name
Enter the name of the container in the storage
account that contains the license and public key
Storage Account
Access Key
Enter the access key of the storage account that
contains the license and public key
For instructions on finding your access key, see To
find your access key.
Vault License File
Enter the name of the Vault license file in the
container (this field is case sensitive)
license.xml
Name
Description
Default
Recovery Public Key
Enter the name of the public key file in the container
(this field is case sensitive)
recpub.key
Primary Vault Information
Primary Vault Admin
Password
Enter a password for the Primary
Vault Administrator user
Primary Vault Master
Password
Enter a password for the Primary Vault Master user
DR User Secret
(Optional) Enter a secret string for the DR user
Administrator
Valid values: A-Z, a-z, 0-9, all special characters
(except / \ - ; and controlled characters )
*Minimum 10 characters
DR User Password
Enter the DR user password
Vault Machine Information
Primary Vault VM
Name
Enter the name of the Primary Vault VM
Primary Vault
Primary Vault VM
Size
Enter the size of the Primary Vault VM
Standard_D8s_v3
Primary
Vault VM Admin User
Enter the Primary Vault VM Administrator user name
Primary
Vault VM Admin
Password
Enter the Vault Primary VM Administrator password
Image ID
Enter the Vault Image ID
Availability Zone
Enter the Availability Zone for the Primary
Vault Deployment
1
Primary Vault VNet
Name
Enter the Vnet where the Primary Vault instance will
reside
PAS-VNet
Primary Vault Subnet
Name
Enter the Subnet Name where the Primary
Vault instance will reside
Vault-Subnet