Skip to content

Commit 0ee7869

Browse files
tamramtamram
committed
remove PSH/CLI samples temporarily
1 parent 206d9ab commit 0ee7869

3 files changed

+7
-137
lines changed

‎articles/storage/common/customer-managed-keys-configure-cross-tenant-existing-account.md

Lines changed: 4 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ author: tamram
77

88
ms.service: storage
99
ms.topic: how-to
10-
ms.date: 08/29/2022
10+
ms.date: 08/31/2022
1111
ms.author: tamram
1212
ms.reviewer: ozgun
1313
ms.subservice: common
@@ -93,13 +93,6 @@ When you configure encryption with customer-managed keys for an existing storage
9393
>
9494
> Azure Storage checks the key vault for a new key version only once daily. When you rotate a key in Azure Key Vault, be sure to wait 24 hours before disabling the older version.
9595
96-
### Configure encryption for automatic updating of key versions
97-
98-
Azure Storage can automatically update the customer-managed key that is used for encryption to use the latest key version from the key vault. Azure Storage checks the key vault daily for a new version of the key. When a new version becomes available, then Azure Storage automatically begins using the latest version of the key for encryption.
99-
100-
> [!IMPORTANT]
101-
> Azure Storage checks the key vault for a new key version only once daily. When you rotate a key, be sure to wait 24 hours before disabling the older version.
102-
10396
### [Azure portal](#tab/portal)
10497

10598
To configure cross-tenant customer-managed keys for an existing storage account in the Azure portal, follow these steps:
@@ -126,106 +119,11 @@ After you've specified the key from the key vault in the customer's tenant, the
126119

127120
### [PowerShell](#tab/powershell)
128121

129-
To configure cross-tenant customer-managed keys for an existing account with PowerShell, install the [Az.Storage](https://www.powershellgallery.com/packages/Az.Storage/4.4.2-preview) module, version 4.4.2-preview.
130-
131-
Next, call [Set-AzStorageAccount](/powershell/module/az.storage/set-azstorageaccount) to update the storage account's encryption settings, omitting the key version. Include the **-KeyvaultEncryption** option to enable customer-managed keys for the storage account.
132-
133-
```azurepowershell
134-
Set-AzStorageAccount -ResourceGroupName <resource-group> `
135-
-AccountName <storage-account> `
136-
-KeyvaultEncryption `
137-
-KeyName $key.Name `
138-
-KeyVaultUri $keyVault.VaultUri
139-
```
122+
N/A
140123

141124
### [Azure CLI](#tab/azure-cli)
142125

143-
To configure customer-managed keys for an existing account with automatic updating of the key version with Azure CLI, install [Azure CLI version 2.4.0](/cli/azure/release-notes-azure-cli#april-21-2020) or later. For more information, see [Install the Azure CLI](/cli/azure/install-azure-cli).
144-
145-
Next, call [az storage account update](/cli/azure/storage/account#az-storage-account-update) to update the storage account's encryption settings, omitting the key version. Include the `--encryption-key-source` parameter and set it to `Microsoft.Keyvault` to enable customer-managed keys for the account.
146-
147-
```azurecli
148-
key_vault_uri=$(az keyvault show \
149-
--name <key-vault> \
150-
--resource-group <resource_group> \
151-
--query properties.vaultUri \
152-
--output tsv)
153-
az storage account update
154-
--name <storage-account> \
155-
--resource-group <resource_group> \
156-
--encryption-key-name <key> \
157-
--encryption-key-source Microsoft.Keyvault \
158-
--encryption-key-vault $key_vault_uri
159-
```
160-
161-
---
162-
163-
### Configure encryption for manual updating of key versions
164-
165-
If you prefer to manually update the key version, then explicitly specify the version at the time that you configure encryption with customer-managed keys. In this case, Azure Storage will not automatically update the key version when a new version is created in the key vault. To use a new key version, you must manually update the version used for Azure Storage encryption.
166-
167-
# [Azure portal](#tab/portal)
168-
169-
To configure customer-managed keys with manual updating of the key version in the Azure portal, specify the key URI, including the version. To specify a key as a URI, follow these steps:
170-
171-
1. To locate the key URI in the Azure portal, navigate to your key vault, and select the **Keys** setting. Select the desired key, then click the key to view its versions. Select a key version to view the settings for that version.
172-
1. Copy the value of the **Key Identifier** field, which provides the URI.
173-
174-
:::image type="content" source="media/customer-managed-keys-configure-existing-account/portal-copy-key-identifier.png" alt-text="Screenshot showing key vault key URI in Azure portal.":::
175-
176-
1. In the **Encryption key** settings for your storage account, choose the **Enter key URI** option.
177-
1. Paste the URI that you copied into the **Key URI** field. Omit the key version from the URI to enable automatic updating of the key version.
178-
179-
:::image type="content" source="media/customer-managed-keys-configure-existing-account/portal-specify-key-uri.png" alt-text="Screenshot showing how to enter key URI in Azure portal.":::
180-
181-
1. Specify the subscription that contains the key vault.
182-
1. Specify either a system-assigned or user-assigned managed identity.
183-
1. Save your changes.
184-
185-
# [PowerShell](#tab/powershell)
186-
187-
To configure customer-managed keys with manual updating of the key version, explicitly provide the key version when you configure encryption for the storage account. Call [Set-AzStorageAccount](/powershell/module/az.storage/set-azstorageaccount) to update the storage account's encryption settings, as shown in the following example, and include the **-KeyvaultEncryption** option to enable customer-managed keys for the storage account.
188-
189-
Remember to replace the placeholder values in brackets with your own values and to use the variables defined in the previous examples.
190-
191-
```azurepowershell
192-
Set-AzStorageAccount -ResourceGroupName <resource-group> `
193-
-AccountName <storage-account> `
194-
-KeyvaultEncryption `
195-
-KeyName $key.Name `
196-
-KeyVersion $key.Version `
197-
-KeyVaultUri $keyVault.VaultUri
198-
```
199-
200-
When you manually update the key version, you will need to update the storage account's encryption settings to use the new version. First, call [Get-AzKeyVaultKey](/powershell/module/az.keyvault/get-azkeyvaultkey) to get the latest version of the key. Then call [Set-AzStorageAccount](/powershell/module/az.storage/set-azstorageaccount) to update the storage account's encryption settings to use the new version of the key, as shown in the previous example.
201-
202-
# [Azure CLI](#tab/azure-cli)
203-
204-
To configure customer-managed keys with manual updating of the key version, explicitly provide the key version when you configure encryption for the storage account. Call [az storage account update](/cli/azure/storage/account#az-storage-account-update) to update the storage account's encryption settings, as shown in the following example. Include the `--encryption-key-source` parameter and set it to `Microsoft.Keyvault` to enable customer-managed keys for the account.
205-
206-
Remember to replace the placeholder values in brackets with your own values.
207-
208-
```azurecli
209-
key_vault_uri=$(az keyvault show \
210-
--name <key-vault> \
211-
--resource-group <resource_group> \
212-
--query properties.vaultUri \
213-
--output tsv)
214-
key_version=$(az keyvault key list-versions \
215-
--name <key> \
216-
--vault-name <key-vault> \
217-
--query [-1].kid \
218-
--output tsv | cut -d '/' -f 6)
219-
az storage account update
220-
--name <storage-account> \
221-
--resource-group <resource_group> \
222-
--encryption-key-name <key> \
223-
--encryption-key-version $key_version \
224-
--encryption-key-source Microsoft.Keyvault \
225-
--encryption-key-vault $key_vault_uri
226-
```
227-
228-
When you manually update the key version, you will need to update the storage account's encryption settings to use the new version. First, query for the key vault URI by calling [az keyvault show](/cli/azure/keyvault#az-keyvault-show), and for the key version by calling [az keyvault key list-versions](/cli/azure/keyvault/key#az-keyvault-key-list-versions). Then call [az storage account update](/cli/azure/storage/account#az-storage-account-update) to update the storage account's encryption settings to use the new version of the key, as shown in the previous example.
126+
N/A
229127

230128
---
231129

@@ -238,4 +136,4 @@ When you manually update the key version, you will need to update the storage ac
238136
## See also
239137

240138
- [Customer-managed keys for Azure Storage encryption](customer-managed-keys-overview.md)
241-
- [Configure cross-tenant customer-managed keys for a new storage account](customer-managed-keys-configure-cross-tenant-new-account.md)
139+
- [Configure cross-tenant customer-managed keys for a new storage account](customer-managed-keys-configure-cross-tenant-new-account.md)

‎articles/storage/common/customer-managed-keys-configure-cross-tenant-new-account.md

Lines changed: 2 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -111,39 +111,11 @@ To configure cross-tenant customer-managed keys for a new storage account in the
111111

112112
### [PowerShell](#tab/powershell)
113113

114-
To configure cross-tenant customer-managed keys for a new storage account, install the [Az.Storage](https://www.powershellgallery.com/packages/Az.Storage/4.4.2-preview) module, version 4.4.2-preview. Next, call [New-AzStorageAccount](/powershell/module/az.storage/new-azstorageaccount), as shown in the following example. Use the variable you created previously for the resource ID for the user-assigned managed identity. You will also need the key vault URI and key name:
115-
116-
```azurepowershell
117-
New-AzStorageAccount -ResourceGroupName <resource-group> `
118-
-Name <storage-account> `
119-
-Kind StorageV2 `
120-
-SkuName Standard_LRS `
121-
-Location $location `
122-
-IdentityType SystemAssignedUserAssigned `
123-
-UserAssignedIdentityId $userIdentity.Id `
124-
-KeyVaultUri $keyVault.VaultUri `
125-
-KeyName $key.Name `
126-
-KeyVaultUserAssignedIdentityId $userIdentity.Id
127-
```
114+
N/A
128115

129116
### [Azure CLI](#tab/azure-cli)
130117

131-
To configure customer-managed keys for a new storage account with automatic updating of the key version, call [az storage account create](/cli/azure/storage/account#az-storage-account-create), as shown in the following example. Use the variable you created previously for the resource ID for the user-assigned managed identity. You will also need the key vault URI and key name:
132-
133-
```azurecli
134-
az storage account create \
135-
--name <storage-account> \
136-
--resource-group <resource-group> \
137-
--location <location> \
138-
--sku Standard_LRS \
139-
--kind StorageV2 \
140-
--identity-type SystemAssigned,UserAssigned \
141-
--user-identity-id <user-assigned-managed-identity> \
142-
--encryption-key-vault <key-vault-uri> \
143-
--encryption-key-name <key-name> \
144-
--encryption-key-source Microsoft.Keyvault \
145-
--key-vault-user-identity-id <user-assigned-managed-identity>
146-
```
118+
N/A
147119

148120
---
149121

‎articles/storage/common/customer-managed-keys-configure-existing-account.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ author: tamram
77

88
ms.service: storage
99
ms.topic: how-to
10-
ms.date: 08/24/2022
10+
ms.date: 08/31/2022
1111
ms.author: tamram
1212
ms.reviewer: ozgun
1313
ms.subservice: common

0 commit comments

Comments
 (0)