|
| 1 | +--- |
| 2 | +title: Use customer-managed keys with Azure Key Vault to manage account encryption |
| 3 | +titleSuffix: Azure Storage |
| 4 | +description: You can use your own encryption key to protect the data in your storage account. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Customer-managed keys offer greater flexibility to manage access controls. |
| 5 | +services: storage |
| 6 | +author: tamram |
| 7 | + |
| 8 | +ms.service: storage |
| 9 | +ms.date: 03/12/2020 |
| 10 | +ms.topic: conceptual |
| 11 | +ms.author: tamram |
| 12 | +ms.reviewer: cbrooks |
| 13 | +ms.subservice: common |
| 14 | +--- |
| 15 | + |
| 16 | +# Use customer-managed keys with Azure Key Vault to manage Azure Storage encryption |
| 17 | + |
| 18 | +You can use your own encryption key to protect the data in your storage account. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Customer-managed keys offer greater flexibility to manage access controls. |
| 19 | + |
| 20 | +You must use Azure Key Vault to store your customer-managed keys. You can either create your own keys and store them in a key vault, or you can use the Azure Key Vault APIs to generate keys. The storage account and the key vault must be in the same region and in the same Azure Active Directory (Azure AD) tenant, but they can be in different subscriptions. For more information about Azure Key Vault, see [What is Azure Key Vault?](../../key-vault/key-vault-overview.md). |
| 21 | + |
| 22 | +## About customer-managed keys |
| 23 | + |
| 24 | +The following diagram shows how Azure Storage uses Azure Active Directory and Azure Key Vault to make requests using the customer-managed key: |
| 25 | + |
| 26 | + |
| 27 | + |
| 28 | +The following list explains the numbered steps in the diagram: |
| 29 | + |
| 30 | +1. An Azure Key Vault admin grants permissions to encryption keys to the managed identity that's associated with the storage account. |
| 31 | +2. An Azure Storage admin configures encryption with a customer-managed key for the storage account. |
| 32 | +3. Azure Storage uses the managed identity that's associated with the storage account to authenticate access to Azure Key Vault via Azure Active Directory. |
| 33 | +4. Azure Storage wraps the account encryption key with the customer key in Azure Key Vault. |
| 34 | +5. For read/write operations, Azure Storage sends requests to Azure Key Vault to unwrap the account encryption key to perform encryption and decryption operations. |
| 35 | + |
| 36 | +## Create an account that supports customer-managed keys for queues and tables |
| 37 | + |
| 38 | +Data stored in the Queue and Table services is not automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services at the time that you create the storage account to be included in this protection. |
| 39 | + |
| 40 | +For more information about how to create a storage account that supports customer-managed keys for queues and tables, see [Create an account that supports customer-managed keys for tables and queues](account-encryption-key-create.md). |
| 41 | + |
| 42 | +Data in the Blob and File services is always protected by customer-managed keys when customer-managed keys are configured for the storage account. |
| 43 | + |
| 44 | +## Enable customer-managed keys for a storage account |
| 45 | + |
| 46 | +Customer-managed keys can enabled only on existing storage accounts. The key vault must be provisioned with access policies that grant key permissions to the managed identity that is associated with the storage account. The managed identity is available only after the storage account is created. |
| 47 | + |
| 48 | +When you configure a customer-managed key, Azure Storage wraps the root data encryption key for the account with the customer-managed key in the associated key vault. Enabling customer-managed keys does not impact performance, and takes effect immediately. |
| 49 | + |
| 50 | +When you modify the key being used for Azure Storage encryption by enabling or disabling customer-managed keys, updating the key version, or specifying a different key, then the encryption of the root key changes, but the data in your Azure Storage account does not need to be re-encrypted. |
| 51 | + |
| 52 | +When you enable or disable customer managed keys, or when you modify the key or the key version, the protection of the root encryption key changes, but the data in your Azure Storage account does not need to be re-encrypted. |
| 53 | + |
| 54 | +To learn how to use customer-managed keys with Azure Key Vault for Azure Storage encryption, see one of these articles: |
| 55 | + |
| 56 | +- [Configure customer-managed keys with Key Vault for Azure Storage encryption from the Azure portal](storage-encryption-keys-portal.md) |
| 57 | +- [Configure customer-managed keys with Key Vault for Azure Storage encryption from PowerShell](storage-encryption-keys-powershell.md) |
| 58 | +- [Configure customer-managed keys with Key Vault for Azure Storage encryption from Azure CLI](storage-encryption-keys-cli.md) |
| 59 | + |
| 60 | +> [!IMPORTANT] |
| 61 | +> Customer-managed keys rely on managed identities for Azure resources, a feature of Azure AD. Managed identities do not currently support cross-directory scenarios. When you configure customer-managed keys in the Azure portal, a managed identity is automatically assigned to your storage account under the covers. If you subsequently move the subscription, resource group, or storage account from one Azure AD directory to another, the managed identity associated with the storage account is not transferred to the new tenant, so customer-managed keys may no longer work. For more information, see **Transferring a subscription between Azure AD directories** in [FAQs and known issues with managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/known-issues.md#transferring-a-subscription-between-azure-ad-directories). |
| 62 | +
|
| 63 | +## Store customer-managed keys in Azure Key Vault |
| 64 | + |
| 65 | +To enable customer-managed keys on a storage account, you must use an Azure Key Vault to store your keys. You must enable both the **Soft Delete** and **Do Not Purge** properties on the key vault. |
| 66 | + |
| 67 | +Only RSA keys of size 2048 are supported with Azure Storage encryption. For more information about keys, see **Key Vault keys** in [About Azure Key Vault keys, secrets and certificates](../../key-vault/about-keys-secrets-and-certificates.md#key-vault-keys). |
| 68 | + |
| 69 | +## Rotate customer-managed keys |
| 70 | + |
| 71 | +You can rotate a customer-managed key in Azure Key Vault according to your compliance policies. When the key is rotated, you must update the storage account to use the new key version URI. To learn how to update the storage account to use a new version of the key in the Azure portal, see the section titled **Update the key version** in [Configure customer-managed keys for Azure Storage by using the Azure portal](storage-encryption-keys-portal.md). |
| 72 | + |
| 73 | +Rotating the key does not trigger re-encryption of data in the storage account. There is no further action required from the user. |
| 74 | + |
| 75 | +## Revoke access to customer-managed keys |
| 76 | + |
| 77 | +You can revoke the storage account's access to the customer-managed key at any time. After access to customer-managed keys is revoked, or after the key has been disabled or deleted, clients cannot call operations that read from or write to a blob or its metadata. Attempts to call any of the following operations will fail with error code 403 (Forbidden) for all users: |
| 78 | + |
| 79 | +- [List Blobs](/rest/api/storageservices/list-blobs), when called with the `include=metadata` parameter on the request URI |
| 80 | +- [Get Blob](/rest/api/storageservices/get-blob) |
| 81 | +- [Get Blob Properties](/rest/api/storageservices/get-blob-properties) |
| 82 | +- [Get Blob Metadata](/rest/api/storageservices/get-blob-metadata) |
| 83 | +- [Set Blob Metadata](/rest/api/storageservices/set-blob-metadata) |
| 84 | +- [Snapshot Blob](/rest/api/storageservices/snapshot-blob), when called with the `x-ms-meta-name` request header |
| 85 | +- [Copy Blob](/rest/api/storageservices/copy-blob) |
| 86 | +- [Copy Blob From URL](/rest/api/storageservices/copy-blob-from-url) |
| 87 | +- [Set Blob Tier](/rest/api/storageservices/set-blob-tier) |
| 88 | +- [Put Block](/rest/api/storageservices/put-block) |
| 89 | +- [Put Block From URL](/rest/api/storageservices/put-block-from-url) |
| 90 | +- [Append Block](/rest/api/storageservices/append-block) |
| 91 | +- [Append Block From URL](/rest/api/storageservices/append-block-from-url) |
| 92 | +- [Put Blob](/rest/api/storageservices/put-blob) |
| 93 | +- [Put Page](/rest/api/storageservices/put-page) |
| 94 | +- [Put Page From URL](/rest/api/storageservices/put-page-from-url) |
| 95 | +- [Incremental Copy Blob](/rest/api/storageservices/incremental-copy-blob) |
| 96 | + |
| 97 | +To call these operations again, restore access to the customer-managed key. |
| 98 | + |
| 99 | +All data operations that are not listed in this section may proceed after customer-managed keys are revoked or a key is disabled or deleted. |
| 100 | + |
| 101 | +To revoke access to customer-managed keys, use [PowerShell](storage-encryption-keys-powershell.md#revoke-customer-managed-keys) or [Azure CLI](storage-encryption-keys-cli.md#revoke-customer-managed-keys). |
| 102 | + |
| 103 | +## Customer-managed keys for Azure managed disks |
| 104 | + |
| 105 | +Customer-managed keys are also available for managing encryption of Azure managed disks. Customer-managed keys behave differently for managed disks than for Azure Storage resources. For more information, see [Server-side encryption of Azure managed disks](../../virtual-machines/windows/disk-encryption.md) for Windows or [Server side encryption of Azure managed disks](../../virtual-machines/linux/disk-encryption.md) for Linux. |
| 106 | + |
| 107 | +## Next steps |
| 108 | + |
| 109 | +- [Configure customer-managed keys with Key Vault for Azure Storage encryption from the Azure portal](storage-encryption-keys-portal.md) |
| 110 | +- [Configure customer-managed keys with Key Vault for Azure Storage encryption from PowerShell](storage-encryption-keys-powershell.md) |
| 111 | +- [Configure customer-managed keys with Key Vault for Azure Storage encryption from Azure CLI](storage-encryption-keys-cli.md) |
| 112 | +- [Azure Storage encryption for data at rest](storage-service-encryption.md) |
0 commit comments