|
| 1 | +--- |
| 2 | +title: Learn how to manage keys for Elastic SAN Preview |
| 3 | +titleSuffix: Azure Elastic SAN Storage |
| 4 | +description: Learn how to manage keys for Elastic SAN Preview |
| 5 | +author: roygara |
| 6 | + |
| 7 | +ms.service: azure-elastic-san-storage |
| 8 | +ms.topic: how-to |
| 9 | +ms.date: 11/06/2023 |
| 10 | +ms.author: rogarana |
| 11 | +ms.reviewer: jaylansdaal |
| 12 | +--- |
| 13 | + |
| 14 | +# Learn how to manage keys for Elastic SAN Preview |
| 15 | + |
| 16 | +All data written to an Elastic SAN volume is automatically encrypted-at-rest with a data encryption key (DEK). Azure DEKs are always *platform-managed* (managed by Microsoft). Azure uses [envelope encryption](../../security/fundamentals/encryption-atrest.md#envelope-encryption-with-a-key-hierarchy), also referred to as wrapping, which involves using a Key Encryption Key (KEK) to encrypt the DEK. By default, the KEK is platform-managed, but you can create and manage your own KEK. [Customer-managed keys](elastic-san-encryption-overview.md#customer-managed-keys) offer greater flexibility to manage access controls and can help you meet your organization security and compliance requirements. |
| 17 | + |
| 18 | +You control all aspects of your key encryption keys, including: |
| 19 | + |
| 20 | +- Which key is used |
| 21 | +- Where your keys are stored |
| 22 | +- How the keys are rotated |
| 23 | +- The ability to switch between customer-managed and platform-managed keys |
| 24 | + |
| 25 | +This article tells you how to manage your customer-managed KEKs. |
| 26 | + |
| 27 | +> [!NOTE] |
| 28 | +> Envelope encryption allows you to change your key configuration without impacting your Elastic SAN volumes. When you make a change, the Elastic SAN service re-encrypts the data encryption keys with the new keys. The protection of the data encryption key changes, but the data in your Elastic SAN volumes remain encrypted at all times. There is no additional action required on your part to ensure that your data is protected. Changing the key configuration doesn't impact performance, and there is no downtime associated with such a change. |
| 29 | +
|
| 30 | +## Limitations |
| 31 | + |
| 32 | +[!INCLUDE [elastic-san-regions](../../../includes/elastic-san-regions.md)] |
| 33 | + |
| 34 | +## Change the key |
| 35 | + |
| 36 | +You can change the key that you're using for Azure Elastic SAN encryption at any time. |
| 37 | + |
| 38 | +To change the key with PowerShell, call [Update-AzElasticSanVolumeGroup](/powershell/module/az.elasticsan/update-azelasticsanvolumegroup) and provide the new key name and version. If the new key is in a different key vault, then you must also update the key vault URI. |
| 39 | + |
| 40 | + |
| 41 | +If the new key is in a different key vault, you must [grant the managed identity access to the key in the new vault](elastic-san-configure-customer-managed-keys.md#choose-a-managed-identity-to-authorize-access-to-the-key-vault). If you opt for manual updating of the key version, you'll also need to [update the key vault URI](elastic-san-configure-customer-managed-keys.md#manual-key-version-rotation). |
| 42 | + |
| 43 | +## Update the key version |
| 44 | + |
| 45 | +Following cryptographic best practices means to rotate the key that is protecting your Elastic SAN volume group on a regular schedule, typically at least every two years. Azure Elastic SAN never modifies the key in the key vault, but you can configure a key rotation policy to rotate the key according to your compliance requirements. For more information, see [Configure cryptographic key auto-rotation in Azure Key Vault](../../key-vault/keys/how-to-configure-key-rotation.md). |
| 46 | + |
| 47 | +After the key is rotated in the key vault, the customer-managed KEK configuration for your Elastic SAN volume group must be updated to use the new key version. Customer-managed keys support both automatic and manual updating of the KEK version. You can decide which approach you want to use when you initially configure customer-managed keys, or when you update your configuration. |
| 48 | + |
| 49 | +When you modify the key or the key version, the protection of the root encryption key changes, but the data in your Azure Elastic SAN volume group remains encrypted at all times. There's no extra action required on your part to ensure that your data is protected. Rotating the key version doesn't impact performance, and there's no downtime associated with rotating the key version. |
| 50 | + |
| 51 | +> [!IMPORTANT] |
| 52 | +> To rotate a key, create a new version of the key in the key vault, according to your compliance requirements. Azure Elastic SAN does not handle key rotation, so you will need to manage rotation of the key in the key vault. |
| 53 | +> |
| 54 | +> When you rotate the key used for customer-managed keys, that action is not currently logged to the Azure Monitor logs for Azure Elastic SAN. |
| 55 | +
|
| 56 | +### Automatically update the key version |
| 57 | + |
| 58 | +To automatically update a customer-managed key when a new version is available, omit the key version when you enable encryption with customer-managed keys for the Elastic SAN volume group. If the key version is omitted, then Azure Elastic SAN checks the key vault daily for a new version of a customer-managed key. If a new key version is available, then Azure Elastic SAN automatically uses the latest version of the key. |
| 59 | + |
| 60 | +Azure Elastic SAN checks the key vault for a new key version only once daily. When you rotate a key, be sure to wait 24 hours before disabling the older version. |
| 61 | + |
| 62 | +If the Elastic SAN volume group was previously configured for manual updating of the key version and you want to change it to update automatically, you might need to explicitly change the key version to an empty string. For details on how to do this, see [Manual key version rotation](elastic-san-configure-customer-managed-keys.md#manual-key-version-rotation). |
| 63 | + |
| 64 | +### Manually update the key version |
| 65 | + |
| 66 | +To use a specific version of a key for Azure Elastic SAN encryption, specify that key version when you enable encryption with customer-managed keys for the Elastic SAN volume group. If you specify the key version, then Azure Elastic SAN uses that version for encryption until you manually update the key version. |
| 67 | + |
| 68 | +When the key version is explicitly specified, then you must manually update the Elastic SAN volume group to use the new key version URI when a new version is created. To learn how to update the Elastic SAN volume group to use a new version of the key, see [Configure encryption with customer-managed keys stored in Azure Key Vault](elastic-san-configure-customer-managed-keys.md). |
| 69 | + |
| 70 | +## Revoke access to a volume group that uses customer-managed keys |
| 71 | + |
| 72 | +To temporarily revoke access to an Elastic SAN volume group that is using customer-managed keys, disable the key currently being used in the key vault. There's no performance impact or downtime associated with disabling and reenabling the key. |
| 73 | + |
| 74 | +After the key has been disabled, clients can't call operations that read from or write to volumes in the volume group or their metadata. |
| 75 | + |
| 76 | + |
| 77 | +> [!CAUTION] |
| 78 | +> When you disable the key in the key vault, the data in your Azure Elastic SAN volume group remains encrypted, but it becomes inaccessible until you reenable the key. |
| 79 | +
|
| 80 | +To revoke a customer-managed key with PowerShell, call the [Update-AzKeyVaultKey](/powershell/module/az.keyvault/update-azkeyvaultkey) command, as shown in the following example. Remember to replace the placeholder values in brackets with your own values to define the variables, or use the variables defined in the previous examples. |
| 81 | + |
| 82 | +```azurepowershell |
| 83 | +$KvName = "<key-vault-name>" |
| 84 | +$KeyName = "<key-name>" |
| 85 | +$enabled = $false |
| 86 | +# $false to disable the key / $true to enable it |
| 87 | +
|
| 88 | +# Check the current state of the key (before and after enabling/disabling it) |
| 89 | +Get-AzKeyVaultKey -Name $KeyName -VaultName $KvName |
| 90 | +
|
| 91 | +# Disable (or enable) the key |
| 92 | +Update-AzKeyVaultKey -VaultName $KvName -Name $KeyName -Enable $enabled |
| 93 | +``` |
| 94 | + |
| 95 | +## Switch back to platform-managed keys |
| 96 | + |
| 97 | +You can switch from customer-managed keys back to platform-managed keys at any time, using the Azure PowerShell module. |
| 98 | + |
| 99 | +To switch from customer-managed keys back to platform-managed keys with PowerShell, call [Update-AzElasticSanVolumeGroup](/powershell/module/az.elasticsan/update-azelasticsanvolumegroup) with the `-Encryption` option, as shown in the following example. Remember to replace the placeholder values with your own values and to use the variables defined in the previous examples. |
| 100 | + |
| 101 | +```azurepowershell |
| 102 | +Update-AzElasticSanVolumeGroup -ResourceGroupName "ResourceGroupName" -ElasticSanName "ElasticSanName" -Name "ElasticSanVolumeGroupName" -Encryption EncryptionAtRestWithPlatformKey |
| 103 | +``` |
| 104 | + |
| 105 | + |
| 106 | +## See also |
| 107 | + |
| 108 | +- [Configure customer-managed keys for an Elastic SAN volume group](elastic-san-configure-customer-managed-keys.md) |
0 commit comments