You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/service-bus-messaging/configure-customer-managed-key.md
+68-58Lines changed: 68 additions & 58 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,15 +15,14 @@ There are some caveats to the customer managed key for service side encryption.
15
15
You can use Azure Key Vault (including Azure Key Vault Managed HSM) to manage your keys and audit your key usage. You can either create your own keys and store them in a key vault, or you can use the Azure Key Vault APIs to generate keys. For more information about Azure Key Vault, see [What is Azure Key Vault?](/azure/key-vault/general/overview)
16
16
17
17
## Enable customer-managed keys (Azure portal)
18
+
18
19
To enable customer-managed keys in the Azure portal, follow these steps:
19
20
20
21
1. Navigate to your Service Bus Premium namespace.
21
-
2. On the **Settings** page of your Service Bus namespace, select **Encryption**.
22
+
1. On the **Settings** page of your Service Bus namespace, select **Encryption**.
22
23
1. Select the **Customer-managed key encryption at rest** as shown in the following image.
27
26
28
27
> [!NOTE]
29
28
> Currently you can't configure Azure Key Vault Managed HSM through the portal.
@@ -34,55 +33,56 @@ After you enable customer-managed keys, you need to associate the customer manag
34
33
35
34
1. To create a new key vault, follow the Azure Key Vault [Quickstart](/azure/key-vault/general/overview). For more information about importing existing keys, see [About keys, secrets, and certificates](/azure/key-vault/general/about-keys-secrets-certificates).
36
35
37
-
> [!IMPORTANT]
38
-
> Using customer-managed keys with Azure Service Bus requires that the key vault have two required properties configured. They are: **Soft Delete** and **Do Not Purge**. The Soft Delete property is enabled by default when you create a new key vault in the Azure portal whereas the Purge Protection is optional so make sure to select it when creating the Key Vault. Also, if you need to enable these properties on an existing key vault, you must use either PowerShell or Azure CLI.
39
-
40
-
# [Key Vault](#tab/Key-Vault)
41
-
42
-
2. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
3. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
48
-
49
-
```azurecli-interactive
50
-
az keyvault update --name contoso-SB-BYOK-keyvault --resource-group ContosoRG --enable-purge-protection true
2. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
36
+
> [!IMPORTANT]
37
+
> Using customer-managed keys with Azure Service Bus requires that the key vault have two required properties configured. They are: **Soft Delete** and **Do Not Purge**. The Soft Delete property is enabled by default when you create a new key vault in the Azure portal whereas the Purge Protection is optional so make sure to select it when creating the Key Vault. Also, if you need to enable these properties on an existing key vault, you must use either PowerShell or Azure CLI.
3. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
39
+
# [Key Vault](#tab/Key-Vault)
40
+
41
+
2. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
3. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
47
+
48
+
```azurecli-interactive
49
+
az keyvault update --name contoso-SB-BYOK-keyvault --resource-group ContosoRG --enable-purge-protection true
2. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
3. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
60
+
61
+
```azurecli-interactive
62
+
az keyvault update --hsm-name contoso-SB-BYOK-keyvault --resource-group ContosoRG --enable-purge-protection true
63
+
```
64
+
---
61
65
62
-
```azurecli-interactive
63
-
az keyvault update --hsm-name contoso-SB-BYOK-keyvault --resource-group ContosoRG --enable-purge-protection true
64
-
```
65
-
---
66
+
Create keys by following these steps:
66
67
67
-
1. Create keys by following these steps:
68
-
1. To create a new key, select **Generate/Import** from the **Keys** menu under **Settings**.
68
+
1. To create a new key, select **Generate/Import** from the **Keys** menu under **Settings**.
71
71
72
-
1. Set **Options** to **Generate** and give the key a name.
72
+
1. Set **Options** to **Generate** and give the key a name.
73
73
74
-
74
+
75
75
76
-
1. You can now select this key to associate with the Service Bus namespace for encrypting from the drop-down list.
76
+
1. You can now select this key to associate with the Service Bus namespace for encrypting from the drop-down list.
77
+
78
+
77
79
78
-
79
-
> [!NOTE]
80
-
> For redundancy, you can add up to 3 keys. In the event that one of the keys has expired, or is not accessible, the other keys will be used for encryption.
80
+
> [!NOTE]
81
+
> For redundancy, you can add up to 3 keys. In the event that one of the keys has expired, or is not accessible, the other keys will be used for encryption.
81
82
82
-
1. Fill in the details for the key and click **Select**. This enables the encryption of the Microsoft-managed key with your key (customer-managed key).
83
-
83
+
1. Fill in the details for the key and click **Select**. This enables the encryption of the Microsoft-managed key with your key (customer-managed key).
84
84
85
-
> [!IMPORTANT]
85
+
> [!IMPORTANT]
86
86
> If you are looking to use Customer managed key along with [Geo-Disaster Recovery](service-bus-geo-dr.md), please review this section.
87
87
>
88
88
> To enable encryption of Microsoft-managed key with a customer managed key, an [access policy](/azure/key-vault/general/security-features) is set up for the Service Bus' managed identity on the specified Azure KeyVault. This ensures controlled access to the Azure KeyVault from the Azure Service Bus namespace.
@@ -107,16 +107,18 @@ There are two types of managed identities that you can assign to a Service Bus n
107
107
-**System-assigned**: You can enable a managed identity directly on a Service Bus namespace. When you enable a system-assigned managed identity, an identity is created in Microsoft Entra that's tied to the lifecycle of that Service Bus namespace. So when the namespace is deleted, Azure automatically deletes the identity for you. By design, only that Azure resource (namespace) can use this identity to request tokens from Microsoft Entra ID.
108
108
-**User-assigned**: You may also create a managed identity as a standalone Azure resource, which is called user-assigned identity. You can create a user-assigned managed identity and assign it to one or more Service Bus namespaces. When you use user-assigned managed identities, the identity is managed separately from the resources that use it. They aren't tied to the lifecycle of the namespace. You can explicitly delete a user-assigned identity when you no longer need it.
109
109
110
-
For more information, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md).
110
+
For more information, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md).
111
111
112
112
## Encrypt using system-assigned identities (template)
113
-
This section shows how to do the following tasks:
114
113
115
-
1. Create a **premium** Service Bus namespace with a **managed service identity**.
116
-
2. Create a **key vault** and grant the service identity access to the key vault.
117
-
3. Update the Service Bus namespace with the key vault information (key/value).
114
+
This section shows you how to do the following tasks:
115
+
116
+
- Create a **premium** Service Bus namespace with a **managed service identity**.
117
+
- Create a **key vault** and grant the service identity access to the key vault.
118
+
- Update the Service Bus namespace with the key vault information (key/value).
118
119
119
120
### Create a premium Service Bus namespace with managed service identity
121
+
120
122
This section shows you how to create an Azure Service Bus namespace with managed service identity by using an Azure Resource Manager template and PowerShell.
121
123
122
124
1. Create an Azure Resource Manager template to create a Service Bus premium tier namespace with a managed service identity. Name the file: **CreateServiceBusPremiumNamespace.json**:
### Encrypt data in Service Bus namespace with customer-managed key from key vault
212
+
210
213
You have done the following steps so far:
211
214
212
215
1. Created a premium namespace with a managed identity.
@@ -346,6 +349,7 @@ In this step, you update the Service Bus namespace with key vault information.
346
349
1. Create a **premium** Service Bus namespace with the managed user-identity and the key vault information.
347
350
348
351
### Create a user-assigned identity
352
+
349
353
Follow instructions from the [Create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity) article to create a user-assigned identity. You can also create a user-assigned identity using [CLI](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-cli.md), [PowerShell](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-powershell.md), [Azure Resource Manager template](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-arm.md), and [REST](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-rest.md).
350
354
351
355
> [!NOTE]
@@ -552,6 +556,7 @@ This section gives you an example that shows you how to do the following tasks u
552
556
```
553
557
554
558
## Use both user-assigned and system-assigned identities
559
+
555
560
A namespace can have both system-assigned and user-assigned identities at the same time. In this case, the `type` property would be `SystemAssigned`, `UserAssigned` as shown in the following example.
556
561
557
562
```json
@@ -601,6 +606,7 @@ See the following example for using the user-managed identity for the encryption
601
606
```
602
607
603
608
## Enable infrastructure (double) encryption of data
609
+
604
610
If you require a higher level of assurance that your data is secure, you can enable infrastructure level encryption, which is also known as Double Encryption.
605
611
606
612
When infrastructure encryption is enabled, data in the Azure Service Bus is encrypted twice, once at the service level and once at the infrastructure level, using two different encryption algorithms and two different keys. Hence, infrastructure encryption of Azure Service Bus data protects against a scenario where one of the encryption algorithms or keys may be compromised.
@@ -646,10 +652,9 @@ Here are more details:
646
652
647
653
## Considerations when using Geo-Disaster Recovery
648
654
649
-
### Geo-Disaster Recovery - encryption with system-assigned identities
655
+
### Encryption with system-assigned identities
650
656
To enable encryption of Microsoft-managed key with a customer managed key, an [access policy](/azure/key-vault/general/secure-your-key-vault) is set up for a system-assigned managed identity on the specified Azure KeyVault. This step ensures controlled access to the Azure KeyVault from the Azure Service Bus namespace. Therefore, you need to follow these steps:
651
657
652
-
653
658
- If [Geo-Disaster Recovery](service-bus-geo-dr.md) is already enabled for the Service Bus namespace and you're looking to enable customer managed key, then
654
659
- Break the pairing.
655
660
-[Set up the access policy](/azure/key-vault/general/assign-access-policy-portal) for the system-assigned managed identity for both the primary and secondary namespaces to the key vault.
@@ -659,31 +664,36 @@ To enable encryption of Microsoft-managed key with a customer managed key, an [a
659
664
-[Set up the access policy](/azure/key-vault/general/assign-access-policy-portal) for the managed identity for the secondary namespace to the key vault.
660
665
- Pair the primary and secondary namespaces.
661
666
662
-
### Geo-Disaster Recovery - encryption with user-assigned identities
667
+
### Encryption with user-assigned identities
668
+
663
669
Here are a few recommendations:
664
670
665
-
1. Create managed identity and assign Key Vault permissions to your managed identity.
666
-
2. Add the identity as a user assigned identity, and enable encryption with the identity on both namespaces.
667
-
3. Pair namespaces together
671
+
-Create managed identity and assign Key Vault permissions to your managed identity.
672
+
-Add the identity as a user assigned identity, and enable encryption with the identity on both namespaces.
673
+
-Pair namespaces together.
668
674
669
675
Conditions for enabling Geo-Disaster Recovery and Encryption with User-Assigned Identities:
670
676
671
-
1. Secondary namespace must already have Encryption enabled with a User-Assigned identity if it's to be paired with a primary namespace that has Encryption enabled.
672
-
2. It isn't possible to enable Encryption on an already paired primary, even if the secondary has a User-Assigned identity associated with the namespace.
677
+
- Secondary namespace must already have Encryption enabled with a User-Assigned identity if it's to be paired with a primary namespace that has Encryption enabled.
678
+
- It isn't possible to enable Encryption on an already paired primary, even if the secondary has a User-Assigned identity associated with the namespace.
673
679
674
680
## Troubleshoot
675
681
676
682
### Symptom
683
+
677
684
You get an error stating that the Service Bus namespace is disabled because the encryption key is no longer valid.
678
685
679
686
### Cause
687
+
680
688
You may be using the `resource_id` or `version`, which links to a specific version of the key, which may have expired. If a specific version is provided, Service Bus uses that version of the key, even if the key is rotated.
681
689
682
690
### Resolution
691
+
683
692
Use the [`resource__versionless_id` or `versionless_id`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#attributes-reference) instead of using `resource_id` or `version`.
684
693
685
694
## Next steps
695
+
686
696
See the following articles:
687
-
-[Service Bus overview](service-bus-messaging-overview.md)
0 commit comments