You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-machines/linux/disk-encryption.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,15 +20,15 @@ For more information about the cryptographic modules underlying Azure managed di
20
20
21
21
## About encryption key management
22
22
23
-
You can rely on platform-managed keys for the encryption of your managed disk, or you can manage encryption using your own keys (public preview). If you choose to manage encryption with your own keys, you can specify a *customer-managed key* to use for encrypting and decrypting all data in managed disks.
23
+
You can rely on platform-managed keys for the encryption of your managed disk, or you can manage encryption using your own keys. If you choose to manage encryption with your own keys, you can specify a *customer-managed key* to use for encrypting and decrypting all data in managed disks.
24
24
25
25
The following sections describe each of the options for key management in greater detail.
26
26
27
27
## Platform-managed keys
28
28
29
29
By default, managed disks use platform-managed encryption keys. As of June 10, 2017, all new managed disks, snapshots, images, and new data written to existing managed disks are automatically encrypted-at-rest with platform-managed keys.
30
30
31
-
## Customer-managed keys (public preview)
31
+
## Customer-managed keys
32
32
33
33
You can choose to manage encryption at the level of each managed disk, with your own keys. Server-side encryption for managed disks with customer-managed keys offers an integrated experience with Azure Key Vault. You can either import [your RSA keys](../../key-vault/key-vault-hsm-protected-keys.md) to your Key Vault or generate new RSA keys in Azure Key Vault. Azure managed disks handles the encryption and decryption in a fully transparent fashion using [envelope encryption](../../storage/common/storage-client-side-encryption.md#encryption-and-decryption-via-the-envelope-technique). It encrypts data using an [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) 256 based data encryption key (DEK), which is, in turn, protected using your keys. You have to grant access to managed disks in your Key Vault to use your keys for encrypting and decrypting the DEK. This allows you full control of your data and keys. You can disable your keys or revoke access to managed disks at any time. You can also audit the encryption key usage with Azure Key Vault monitoring to ensure that only managed disks or other trusted Azure services are accessing your keys.
34
34
@@ -52,7 +52,7 @@ To revoke access to customer-managed keys, see [Azure Key Vault PowerShell](http
52
52
53
53
### Supported scenarios and restrictions
54
54
55
-
During the preview, only the following scenarios are supported:
55
+
For now, only the following scenarios are supported:
56
56
57
57
- Create a virtual machine (VM) from an Azure Marketplace image and encrypt the OS disk with server-side encryption using customer-managed keys.
58
58
- Create a custom image encrypted with server-side encryption and customer-managed keys.
@@ -61,7 +61,7 @@ During the preview, only the following scenarios are supported:
61
61
- (CLI/PowerShell only) Create snapshots that are encrypted using server-side encryption and customer-managed keys.
62
62
- Create virtual machine scale sets that are encrypted with server-side encryption and customer-managed keys.
63
63
64
-
The preview also has the following restrictions:
64
+
For now, we also have the following restrictions:
65
65
66
66
-**Only available in West Central US, South Central US, East US 2, East US, West US 2, Central Canada, and North Europe.**
67
67
- Disks created from custom images that are encrypted using server-side encryption and customer-managed keys must be encrypted using the same customer-managed keys and must be in the same subscription.
Copy file name to clipboardExpand all lines: articles/virtual-machines/windows/disk-encryption.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,15 +20,15 @@ For more information about the cryptographic modules underlying Azure managed di
20
20
21
21
## About encryption key management
22
22
23
-
You can rely on platform-managed keys for the encryption of your managed disk, or you can manage encryption using your own keys (public preview). If you choose to manage encryption with your own keys, you can specify a *customer-managed key* to use for encrypting and decrypting all data in managed disks.
23
+
You can rely on platform-managed keys for the encryption of your managed disk, or you can manage encryption using your own keys. If you choose to manage encryption with your own keys, you can specify a *customer-managed key* to use for encrypting and decrypting all data in managed disks.
24
24
25
25
The following sections describe each of the options for key management in greater detail.
26
26
27
27
## Platform-managed keys
28
28
29
29
By default, managed disks use platform-managed encryption keys. As of June 10, 2017, all new managed disks, snapshots, images, and new data written to existing managed disks are automatically encrypted-at-rest with platform-managed keys.
30
30
31
-
## Customer-managed keys (public preview)
31
+
## Customer-managed keys
32
32
33
33
You can choose to manage encryption at the level of each managed disk, with your own keys. Server-side encryption for managed disks with customer-managed keys offers an integrated experience with Azure Key Vault. You can either import [your RSA keys](../../key-vault/key-vault-hsm-protected-keys.md) to your Key Vault or generate new RSA keys in Azure Key Vault. Azure managed disks handles the encryption and decryption in a fully transparent fashion using [envelope encryption](../../storage/common/storage-client-side-encryption.md#encryption-and-decryption-via-the-envelope-technique). It encrypts data using an [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) 256 based data encryption key (DEK), which is, in turn, protected using your keys. You have to grant access to managed disks in your Key Vault to use your keys for encrypting and decrypting the DEK. This allows you full control of your data and keys. You can disable your keys or revoke access to managed disks at any time. You can also audit the encryption key usage with Azure Key Vault monitoring to ensure that only managed disks or other trusted Azure services are accessing your keys.
34
34
@@ -52,7 +52,7 @@ To revoke access to customer-managed keys, see [Azure Key Vault PowerShell](http
52
52
53
53
### Supported scenarios and restrictions
54
54
55
-
During the preview, only the following scenarios are supported:
55
+
For now, only the following scenarios are supported:
56
56
57
57
- Create a virtual machine (VM) from an Azure Marketplace image and encrypt the OS disk with server-side encryption using customer-managed keys.
58
58
- Create a custom image encrypted with server-side encryption and customer-managed keys.
@@ -62,7 +62,7 @@ During the preview, only the following scenarios are supported:
62
62
- Create virtual machine scale sets that are encrypted with server-side encryption and customer-managed keys.
63
63
-["Soft" and "Hard" RSA keys](../../key-vault/about-keys-secrets-and-certificates.md#keys-and-key-types) of size 2080 are supported.
64
64
65
-
The preview also has the following restrictions:
65
+
For now, we also have the following restrictions:
66
66
67
67
-**Only available in West Central US, South Central US, East US 2, East US, West US 2, Central Canada, and North Europe.**
68
68
- Disks created from custom images that are encrypted using server-side encryption and customer-managed keys must be encrypted using the same customer-managed keys and must be in the same subscription.
0 commit comments