You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/customer-managed-keys.md
+16-43Lines changed: 16 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -69,37 +69,6 @@ The following rules apply:
69
69
70
70
Customer-managed key configuration isn't supported in Azure portal currently and provisioning can be performed via [PowerShell](/powershell/module/az.operationalinsights/), [CLI](/cli/azure/monitor/log-analytics) or [REST](/rest/api/loganalytics/) requests.
71
71
72
-
### Asynchronous operations and status check
73
-
74
-
Some of the configuration steps run asynchronously because they can't be completed quickly. The `status` in response can be one of the followings: 'InProgress', 'Updating', 'Deleting', 'Succeeded or 'Failed' with error code.
75
-
76
-
# [Azure portal](#tab/portal)
77
-
78
-
N/A
79
-
80
-
# [Azure CLI](#tab/azure-cli)
81
-
82
-
N/A
83
-
84
-
# [PowerShell](#tab/powershell)
85
-
86
-
N/A
87
-
88
-
# [REST](#tab/rest)
89
-
90
-
When using REST, the response initially returns an HTTP status code 202 (Accepted) and header with *Azure-AsyncOperation* property:
You can check the status of the asynchronous operation by sending a GET request to the endpoint in *Azure-AsyncOperation* header:
96
-
```rst
97
-
GET https://management.azure.com/subscriptions/subscription-id/providers/microsoft.operationalInsights/locations/region-name/operationstatuses/operation-id?api-version=2021-06-01
98
-
Authorization: Bearer <token>
99
-
```
100
-
101
-
---
102
-
103
72
## Storing encryption key (KEK)
104
73
105
74
Create or use existing Azure Key Vault in the region that the cluster is planed, then generate or import a key to be used for logs encryption. The Azure Key Vault must be configured as recoverable to protect your key and the access to your data in Azure Monitor. You can verify this configuration under properties in your Key Vault, both *Soft delete* and *Purge protection* should be enabled.
@@ -113,7 +82,7 @@ These settings can be updated in Key Vault via CLI and PowerShell:
113
82
114
83
## Create cluster
115
84
116
-
Clusters support System-assigned managed identity and identity `type` property should be set to `SystemAssigned`. The identity is being generated automatically with the cluster creation and can be used later to grant storage access to your Key Vault for wrap and unwrap operations.
85
+
Clusters uses managed identity for data encryption with your Key Vault. Configure identity `type` property to `SystemAssigned` when creating your cluster to allow access to your Key Vault for wrap and unwrap operations.
117
86
118
87
Identity settings in cluster for System-assigned managed identity
It takes the propagation of the key a while to complete. You can check the update state in two ways:
199
-
1. Copy the Azure-AsyncOperation URL value from the response and follow the [asynchronous operations status check](#asynchronous-operations-and-status-check).
200
-
2. Send a GET request on the cluster and look at the *KeyVaultProperties* properties. Your recently updated key should return in the response.
175
+
It takes the propagation of the key a while to complete. You can check the update state by sending GET request on the cluster and look at the *KeyVaultProperties* properties. Your recently updated key should return in the response.
201
176
202
177
A response to GET request should look like this when the key update is complete:
@@ -458,9 +433,7 @@ Customer-Managed key is provided on dedicated cluster and these operations are r
458
433
459
434
- If you update your key version in Key Vault and don't update the new key identifier details in the cluster, the Log Analytics cluster will keep using your previous key and your data will become inaccessible. Update new key identifier details in the cluster to resume data ingestion and ability to query data.
460
435
461
-
- Some operations are long and can take a while to complete -- these are cluster create, cluster key update and cluster delete. You can check the operation status in two ways:
462
-
1. when using REST, copy the Azure-AsyncOperation URL value from the response and follow the [asynchronous operations status check](#asynchronous-operations-and-status-check).
463
-
2. Send GET request to cluster or workspace and observe the response. For example, unlinked workspace won't have the *clusterResourceId* under *features*.
436
+
- Some operations are long and can take a while to complete -- these are cluster create, cluster key update and cluster delete. You can check the operation status by sending GET request to cluster or workspace and observe the response. For example, unlinked workspace won't have the *clusterResourceId* under *features*.
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/logs-dedicated-clusters.md
+19-37Lines changed: 19 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,21 +48,6 @@ If your workspace is using legacy Per Node pricing tier, when it is linked to a
48
48
49
49
Complete details are billing for Log Analytics dedicated clusters are available [here](./manage-cost-storage.md#log-analytics-dedicated-clusters).
50
50
51
-
## Asynchronous operations and status check
52
-
53
-
Some of the configuration steps run asynchronously because they can't be completed quickly. The status in response contains can be one of the following values: *InProgress*, *Updating*, *Deleting*, *Succeeded*, or *Failed* including the error code. When using REST, the response initially returns an HTTP status code 202 (Accepted) and header with Azure-AsyncOperation property:
You can check the status of the asynchronous operation by sending a GET request to the Azure-AsyncOperation header value:
60
-
61
-
```rest
62
-
GET https://management.azure.com/subscriptions/subscription-id/providers/microsoft.operationalInsights/locations/region-name/operationstatuses/operation-id?api-version=2021-06-01
63
-
Authorization: Bearer <token>
64
-
```
65
-
66
51
## Create a dedicated cluster
67
52
68
53
You must specify the following properties when you create a new dedicated cluster:
@@ -86,12 +71,13 @@ You can have up to 2 active clusters per subscription per region. If the cluster
When a cluster is configured with customer-managed keys, data ingested to the workspaces after the link operation completion is stored encrypted with your managed key. The workspace link operation can take up to 90 minutes to complete and you can check the state in two ways:
283
-
284
-
- Copy the Azure-AsyncOperation URL value from the response and follow the asynchronous operations status check.
285
-
- Perform Get operation on the workspace and observe if *clusterResourceId* property is present in the response under *features*.
269
+
When a cluster is configured with customer-managed keys, data ingested to the workspaces after the link operation completion is stored encrypted with your managed key. The workspace link operation can take up to 90 minutes to complete and you can check the state by sending Get request to workspace and observe if *clusterResourceId* property is present in the response under *features*.
az account set --subscription "cluster-subscription-id"
574
558
575
559
az monitor log-analytics cluster delete --resource-group "resource-group-name" --name $clusterName
576
560
```
@@ -626,9 +610,7 @@ Authorization: Bearer <token>
626
610
627
611
- If you update your cluster while the cluster is at provisioning or updating state, the update will fail.
628
612
629
-
- Some operations are long and can take a while to complete. These are *cluster create*, *cluster key update* and *cluster delete*. You can check the operation status in two ways:
630
-
- When using REST, copy the Azure-AsyncOperation URL value from the response and follow the [asynchronous operations status check](#asynchronous-operations-and-status-check).
631
-
- Send GET request to cluster or workspace and observe the response. For example, unlinked workspace won't have the *clusterResourceId* under *features*.
613
+
- Some operations are long and can take a while to complete. These are *cluster create*, *cluster key update* and *cluster delete*. You can check the operation status by sending GET request to cluster or workspace and observe the response. For example, unlinked workspace won't have the *clusterResourceId* under *features*.
632
614
633
615
- Workspace link to cluster will fail if it is linked to another cluster.
0 commit comments