Skip to content

Commit 2b65184

Browse files
roygararoygara
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into nonblockUpdate
2 parents c6c899e + e8c04f9 commit 2b65184

File tree

182 files changed

+1923
-540
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

182 files changed

+1923
-540
lines changed

‎articles/automation/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
displayName: certificate renewal
1616
- name: Configure authentication with AWS
1717
href: automation-config-aws-account.md
18+
- name: Encryption of secure assets in Azure Automation
19+
href: automation-secure-asset-encryption.md
1820
- name: Manage role-based access control
1921
href: automation-role-based-access-control.md
2022
displayName: RBAC

‎articles/automation/automation-secure-asset-encryption.md

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
---
2+
title: Encryption of secure assets in automation
3+
description: Azure automation protects secure assets using multiple levels of encryption. By default, the encryption is done using Microsoft-managed keys. Customers can configure their automation accounts to use customer managed keys for encryption. This article describes the details of both modes of encryption and how you can switch between the two.
4+
services: automation
5+
ms.service: automation
6+
ms.subservice: process-automation
7+
author: snehithm
8+
ms.author: snmuvva
9+
ms.date: 01/11/2020
10+
ms.topic: conceptual
11+
manager: kmadnani
12+
---
13+
14+
# Secure assets in Azure Automation
15+
16+
Secure assets in Azure Automation include credentials, certificates, connections, and encrypted variables. These assets are protected in Azure Automation using multiple levels of encryption.
17+
Based on the top-level key used for the encryption, there are two models for encryption:
18+
- Using Microsoft-managed keys
19+
- Using customer-managed keys
20+
21+
### Microsoft-managed Keys
22+
23+
By default, your Azure Automation account uses Microsoft-managed keys.
24+
25+
Each secure asset is encrypted and stored in Azure Automation using a unique key (Data Encryption key) that is generated for each automation account. These keys themselves are encrypted and stored in Azure Automation using yet another unique key that is generated for each account called an Account Encryption Key (AEK). These account encryption keys encrypted and stored in Azure Automation using Microsoft Managed Keys.
26+
27+
### Customer-managed Keys with Key Vault (preview)
28+
29+
You can manage encryption of secure assets in Azure Automation at the level of an automation account with your own keys. When you specify a customer-managed key at the level of the Automation account, that key is used to protect and control access to the account encryption key for the automation account, which in turn is used to encrypt and decrypt all the secure assets. Customer-managed keys offer greater flexibility to create, rotate, disable, and revoke access controls. You can also audit the encryption keys used to protect your secure assets.
30+
31+
You must use Azure Key Vault to store customer-managed keys. You can either create your own keys and store them in a key vault, or you can use the Azure Key Vault APIs to generate keys. For more information about Azure Key Vault, see [What is Azure Key Vault?](../key-vault/key-vault-overview.md)
32+
33+
## Enable customer-managed keys for an Automation account
34+
35+
When you enable encryption with customer-managed keys for an automation account, Azure Automation wraps the account encryption key with the customer-managed key in the associated key vault. Enabling customer-managed keys does not impact performance, and the account is encrypted with the new key immediately, without any time delay.
36+
37+
A new automation account is always encrypted using Microsoft-managed keys. It's not possible to enable customer-managed keys at the time that the account is created. Customer-managed keys are stored in Azure Key Vault, and the key vault must be provisioned with access policies that grant key permissions to the managed identity that is associated with the automation account. The managed identity is available only after the storage account is created.
38+
39+
When you modify the key being used for Azure Automation secure asset encryption by enabling or disabling customer-managed keys, updating the key version, or specifying a different key, then the encryption of the root key changes, but the secure assets in your Azure Automation account do not need to be re-encrypted.
40+
41+
The following three sections describe the mechanics of enabling customer-managed keys for an Automation account.
42+
43+
> [!NOTE]
44+
> To enable customer-managed keys, you will currently need to make Azure Automation REST APIs using api version 2020-01-13-preview
45+
46+
### Pre-requisites for using Customer-managed keys in Azure Automation
47+
48+
Before enabling customer-managed keys for an Automation account, you must ensure the following pre-requisites are met
49+
50+
- The customer-manged key is stored in an Azure Key Vault.
51+
- You must enable both the **Soft Delete** and **Do Not Purge** properties on the key vault. These features are required to allow for recovery of keys in case of accidental deletion.
52+
- Only RSA keys are supported with Azure Automation encryption. For more information about keys, see [About Azure Key Vault keys, secrets, and certificates](../key-vault/about-keys-secrets-and-certificates.md#key-vault-keys).
53+
- The automation account and the key vault can be in different subscriptions but need to be in the same Azure Active Directory tenant.
54+
55+
### Assign an identity to the automation account
56+
57+
To use customer-managed keys with an automation account, your automation account needs to authenticate against the keyvault storing customer-managed keys. Azure Automation uses system assigned managed identities to authenticate the account with Key Vault. For more information about managed identities, see [What is managed identities for Azure resources?](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview)
58+
59+
Configure a system assigned managed identity to the automation account using the following REST API call
60+
61+
```http
62+
PATCH https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resource-group-name/providers/Microsoft.Automation/automationAccounts/automation-account-name?api-version=2020-01-13-preview
63+
```
64+
Request body
65+
```json
66+
{
67+
"identity":
68+
{
69+
"type": "SystemAssigned"
70+
}
71+
}
72+
```
73+
74+
System assigned identity for the automation account is returned in the response
75+
76+
```json
77+
{
78+
"name": "automation-account-name",
79+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resource-group-name/providers/Microsoft.Automation/automationAccounts/automation-account-name",
80+
..
81+
"identity": {
82+
"type": "SystemAssigned",
83+
"principalId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
84+
"tenantId": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
85+
},
86+
..
87+
}
88+
```
89+
90+
### Configure the Key Vault access policy
91+
92+
Once a managed identity is assigned to the Automation account, you configure access to the Key Vault storing customer managed Keys. Azure Automation requires **get**, **recover**, **wrapKey**, **UnwrapKey** on the customer managed keys.
93+
94+
Such an access policy can be set using the following REST API call.
95+
96+
```http
97+
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault/accessPolicies/add?api-version=2018-02-14
98+
```
99+
Request body
100+
101+
```json
102+
{
103+
"properties": {
104+
"accessPolicies": [
105+
{
106+
"tenantId": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
107+
"objectId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
108+
"permissions": {
109+
"keys": [
110+
"get",
111+
"recover",
112+
"wrapKey",
113+
"unwrapKey"
114+
],
115+
"secrets": [],
116+
"certificates": []
117+
}
118+
}
119+
]
120+
}
121+
}
122+
```
123+
124+
> [!NOTE]
125+
> The tenantId and objectId fields must be provided with values of identity.tenantId and identity.principalId from the response of managed identity for the automation account.
126+
127+
### Change the configuration of automation account to use customer managed key
128+
129+
Finally, you can switch your automation account from Microsft-managed keys to customer-managed keys, using the following REST API call.
130+
131+
```http
132+
PATCH https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resource-group-name/providers/Microsoft.Automation/automationAccounts/automation-account-name?api-version=2020-01-13-preview
133+
```
134+
Request body
135+
136+
```json
137+
{
138+
"properties": {
139+
"encryption": {
140+
"keySource": "Microsoft.Keyvault",
141+
"keyvaultProperties": {
142+
"keyName": "sample-vault-key",
143+
"keyvaultUri": "https://sample-vault-key12.vault.azure.net",
144+
"keyVersion": "7c73556c521340209371eaf623cc099d"
145+
}
146+
}
147+
}
148+
}
149+
```
150+
Sample response
151+
152+
```json
153+
{
154+
"name": "automation-account-name",
155+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resource-group-name/providers/Microsoft.Automation/automationAccounts/automation-account-name",
156+
..
157+
"properties": {
158+
..
159+
"encryption": {
160+
"keyvaultProperties": {
161+
"keyName": "sample-vault-key",
162+
"keyvaultUri": "https://sample-vault-key12.vault.azure.net",
163+
"keyVersion": "7c73556c521340209371eaf623cc099d"
164+
},
165+
"keySource": "Microsoft.Keyvault"
166+
},
167+
..
168+
}
169+
}
170+
```
171+
172+
## Manage customer-managed keys lifecycle
173+
174+
### Rotate customer-managed keys
175+
176+
You can rotate a customer-managed key in Azure Key Vault according to your compliance policies. When the key is rotated, you must update the automation account to use the new key URI.
177+
178+
Rotating the key does not trigger re-encryption of data in the storage account. There is no further action required from the user.
179+
180+
## Revoke access to customer-managed keys
181+
182+
To revoke access to customer-managed keys, use PowerShell or Azure CLI. For more information, see [Azure Key Vault PowerShell](https://docs.microsoft.com/powershell/module/az.keyvault/) or [Azure Key Vault CLI](https://docs.microsoft.com/cli/azure/keyvault). Revoking access effectively blocks access to all data in the storage account, as the encryption key is inaccessible by Azure Storage.
183+
184+
## Next steps
185+
186+
- [What is Azure Key Vault?](../key-vault/key-vault-overview.md)
187+
- [Certificate assets in Azure Automation](shared-resources/certificates.md)
188+
- [Credential assets in Azure Automation](shared-resources/credentials.md)
189+
- [Variable assets in Azure Automation](shared-resources/variables.md)

‎articles/azure-maps/about-azure-maps.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Overview of Azure Maps | Microsoft Docs
3-
description: An introduction to Azure Maps
2+
title: Overview | Microsoft Azure Maps
3+
description: In this article, you will learn about services and capabilities in Microsoft Azure Maps and how to utilize them in your applications.
44
author: walsehgal
55
ms.author: v-musehg
66
ms.date: 02/04/2019

‎articles/azure-maps/azure-maps-authentication.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Authentication with Azure Maps | Microsoft Docs
3-
description: Azure Active Directory (Azure AD) or Shared Key authentication for using Microsoft Azure Maps services. Learn how to get Azure Maps subscription key.
2+
title: Authentication methods | Microsoft Azure Maps
3+
description: In this article, you will learn about Azure Active Directory (Azure AD) or Shared Key authentication for using Microsoft Azure Maps services. Learn how to get Azure Maps subscription key.
44
author: walsehgal
55
ms.author: v-musehg
66
ms.date: 12/30/2019

‎articles/azure-maps/azure-maps-event-grid-integration.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: React to Azure Maps events by using Event Grid | Microsoft Docs
3-
description: Learn how to react to Azure Maps events by using Event Grid.
2+
title: React to map events by using Event Grid | Microsoft Azure Maps
3+
description: In this article, you will learn how to react to Microsoft Azure Maps events by using Event Grid.
44
author: walsehgal
55
ms.author: v-musehg
66
ms.date: 02/08/2019

‎articles/azure-maps/choose-map-style.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
2-
title: Choose a map style in Azure Maps
3-
titleSuffix: Azure Maps
4-
description: Learn about Azure Maps style related functionalities.
2+
title: Map style functionalities | Microsoft Azure Maps
3+
description: In this article, you will learn about style related functionalities available in Microsoft Azure Maps web SDK.
54
author: walsehgal
65
ms.author: v-musehg
76
ms.date: 07/29/2019

‎articles/azure-maps/choose-pricing-tier.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Choose the right pricing tier for Azure Maps | Microsoft Docs
3-
description: Learn about pricing tiers offered by Azure Maps
2+
title: Choose the right pricing tier | Microsoft Azure Maps
3+
description: In this article, you will learn about pricing tiers offered by Microsoft Azure Maps.
44
author: walsehgal
55
ms.author: v-musehg
66
ms.date: 01/02/2019

‎articles/azure-maps/clustering-point-data-web-sdk.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Clustering point data in Azure Maps | Microsoft Docs
3-
description: How to cluster point data in the Web SDK
2+
title: Clustering point data on a map | Microsoft Azure Maps
3+
description: In this article, you will learn how to cluster point data and render it on a map using the Microsoft Azure Maps Web SDK.
44
author: rbrundritt
55
ms.author: richbrun
66
ms.date: 07/29/2019

‎articles/azure-maps/consumption-model.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Consumption Model in Azure Maps | Microsoft Docs
3-
description: Learn about consumption model in Azure Maps
2+
title: Vehicle consumption models for routing | Microsoft Azure Maps
3+
description: In this article, you will learn about vehicle consumption models for routing in Microsoft Azure Maps.
44
author: subbarayudukamma
55
ms.author: skamma
66
ms.date: 05/08/2018

‎articles/azure-maps/create-data-source-web-sdk.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Create a data source in Azure Maps | Microsoft Docs
3-
description: How to create a data source and use it with Azure Maps Web SDK.
2+
title: Create a data source for a map | Microsoft Azure Maps
3+
description: In this article, you will learn how to create a data source and add it to a map using the Microsoft Azure Maps Web SDK.
44
author: rbrundritt
55
ms.author: richbrun
66
ms.date: 08/08/2019

0 commit comments

Comments
 (0)