Skip to content

Commit 36dd585

Browse files
committed
Incorporating feedback.
1 parent 6455e15 commit 36dd585

File tree

2 files changed

+3
-2
lines changed

2 files changed

+3
-2
lines changed

articles/virtual-machines/image-version-encryption.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.service: virtual-machines
66
ms.subservice: gallery
77
ms.workload: infrastructure-services
88
ms.topic: how-to
9-
ms.date: 1/11/2023
9+
ms.date: 02/22/2023
1010
ms.custom: devx-track-azurepowershell, devx-track-azurecli
1111
ms.devlang: azurecli
1212
---
@@ -38,6 +38,8 @@ When you're using customer-managed keys for encrypting images in an Azure Comput
3838

3939
- Encryption key sets are regional resources, so each region requires a different encryption key set.
4040

41+
- After you've used your own keys to encrypt an image, you can't go back to using platform-managed keys for encrypting those images.
42+
4143
- VM image version source doesn't currently support customer-managed key encryption.
4244

4345
## PowerShell

includes/virtual-machines-managed-disks-customer-managed-keys-restrictions.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
---
1212
- Only [software and HSM RSA keys](../articles/key-vault/keys/about-keys.md) of sizes 2,048-bit, 3,072-bit and 4,096-bit are supported, no other keys or sizes.
1313
- [HSM](../articles/key-vault/keys/hsm-protected-keys.md) keys require the **premium** tier of Azure Key vaults.
14-
- Disks created from custom images that are encrypted using server-side encryption and customer-managed keys must be encrypted using the same customer-managed keys. Your disks and their images must be in the same subscription, the keys used to encrypt your disks can be in a different subscription.
1514
- For Ultra Disks and Premium SSD v2 only: Snapshots created from disks that are encrypted with server-side encryption and customer-managed keys must be encrypted with the same customer-managed keys.
1615
- Most resources related to your customer-managed keys (disk encryption sets, VMs, disks, and snapshots) must be in the same subscription and region.
1716
- Azure Key Vaults may be used from a different subscription but must be in the same region as your disk encryption set. As a preview, you can use Azure Key Vaults from [different Azure Active Directory tenants](../articles/virtual-machines/disks-cross-tenant-customer-managed-keys.md).

0 commit comments

Comments
 (0)