Skip to content

Commit 38336ef

Browse files
19BMG0019BMG00
authored
Merge pull request #202548 from hickeys/users/ahmedb/cmk
adding article about cmk
2 parents 4a76654 + b314f7f commit 38336ef

File tree

3 files changed

+116
-1
lines changed

3 files changed

+116
-1
lines changed

‎articles/azure-fluid-relay/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
href: concepts/data-storage.md
2121
- name: Data encryption in Azure Fluid Relay
2222
href: concepts/data-encryption.md
23+
- name: Customer-managed keys for Azure Fluid Relay encryption
24+
href: concepts/customer-managed-keys.md
2325
- name: 'Authentication and authorization in your app'
2426
href: concepts/authentication-authorization.md
2527
- name: Version compatibility

‎articles/azure-fluid-relay/concepts/customer-managed-keys.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: Customer-managed keys for Azure Fluid Relay encryption
3+
description: Better understand the data encryption with CMK
4+
author: hickeys
5+
ms.author: hickeys
6+
ms.date: 10/08/2021
7+
ms.service: app-service
8+
ms.topic: reference
9+
---
10+
11+
# Customer-managed keys for Azure Fluid Relay encryption
12+
13+
You can use your own encryption key to protect the data in your Azure Fluid Relay resource. When you specify a customer-managed key (CMK), that key is used to protect and control access to the key that encrypts your data. CMK offers greater flexibility to manage access controls.
14+
15+
You must use one of the following Azure key stores to store your CMK:
16+
- [Azure Key Vault](../../key-vault/general/overview.md)
17+
- [Azure Key Vault Managed Hardware Security Module (HSM)](../../key-vault/managed-hsm/overview.md)
18+
19+
You must create a new Azure Fluid Relay resource to enable CMK. You cannot change the CMK enablement/disablement on an existing Fluid Relay resource.
20+
21+
Also, CMK of Fluid Relay relies on Managed Identity, and you need to assign a managed identity to the Fluid Relay resource when enabling CMK. Only user-assigned identity is allowed for Fluid Relay resource CMK. For more information about managed identities, see [here](../../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types).
22+
23+
Configuring a Fluid Relay resource with CMK can't be done through Azure portal yet.
24+
25+
When you configure the Fluid Relay resource with CMK, the Azure Fluid Relay service configures the appropriate CMK encrypted settings on the Azure Storage account scope where your Fluid session artifacts are stored. For more information about CMK in Azure Storage, see [here](../../storage/common/customer-managed-keys-overview.md).
26+
27+
To verify a Fluid Relay resource is using CMK, you can check the property of the resource by sending GET and see if it has valid, non-empty property of encryption.customerManagedKeyEncryption.
28+
29+
## Prerequisites:
30+
31+
Before configuring CMK on your Azure Fluid Relay resource, the following prerequisites must be met:
32+
- Keys must be stored in an Azure Key Vault.
33+
- Keys must be RSA key and not EC key since EC key doesn’t support WRAP and UNWRAP.
34+
- A user assigned managed identity must be created with necessary permission (GET, WRAP and UNWRAP) to the key vault in step 1. More information [here](../../active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad.md). Please grant GET, WRAP and UNWRAP under Key Permissions in AKV.
35+
- Azure Key Vault, user assigned identity, and the Fluid Relay resource must be in the same region and in the same Azure Active Directory (Azure AD) tenant.
36+
37+
## Create a Fluid Relay resource with CMK
38+
39+
```
40+
PUT https://management.azure.com/subscriptions/<subscription ID>/resourceGroups/<resource group name> /providers/Microsoft.FluidRelay/fluidRelayServers/< Fluid Relay resource name>?api-version=2022-06-01 @"<path to request payload>"
41+
```
42+
43+
Request payload format:
44+
45+
```
46+
{
47+
"location": "<the region you selected for Fluid Relay resource>",
48+
"identity": {
49+
"type": "UserAssigned",
50+
"userAssignedIdentities": {
51+
“<User assigned identity resource ID>": {}
52+
}
53+
},
54+
"properties": {
55+
"encryption": {
56+
"customerManagedKeyEncryption": {
57+
"keyEncryptionKeyIdentity": {
58+
"identityType": "UserAssigned",
59+
"userAssignedIdentityResourceId": "<User assigned identity resource ID>"
60+
},
61+
"keyEncryptionKeyUrl": "<key identifier>"
62+
}
63+
}
64+
}
65+
}
66+
```
67+
68+
Example userAssignedIdentities and userAssignedIdentityResourceId:
69+
/subscriptions/ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/testGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/testUserAssignedIdentity
70+
71+
Example keyEncryptionKeyUrl: https://test-key-vault.vault.azure.net/keys/testKey/testKeyVersionGuid
72+
73+
Notes:
74+
- Identity.type must be UserAssigned. It is the identity type of the managed identity that is assigned to the Fluid Relay resource.
75+
- Properties.encryption.customerManagedKeyEncryption.keyEncryptionKeyIdentity.identityType must be UserAssigned. It is the identity type of the managed identity that should be used for CMK.
76+
- Although you can specify more than one in Identity.userAssignedIdentities, only one user identity assigned to Fluid Relay resource specified will be used for CMK access the key vault for encryption.
77+
- Properties.encryption.customerManagedKeyEncryption.keyEncryptionKeyIdentity.userAssignedIdentityResourceId is the resource ID of the user assigned identity that should be used for CMK. Notice that it should be one of the identities in Identity.userAssignedIdentities (You must assign the identity to Fluid Relay resource before it can use it for CMK). Also, it should have necessary permissions on the key (provided by keyEncryptionKeyUrl).
78+
- Properties.encryption.customerManagedKeyEncryption.keyEncryptionKeyUrl is the key identifier used for CMK.
79+
80+
## Update CMK settings of an existing Fluid Relay resource
81+
82+
You can update the following CMK settings on existing Fluid Relay resource:
83+
- Change the identity that is used for accessing the key encryption key.
84+
- Change the key encryption key identifier (key URL).
85+
- Change the key version of the key encryption key.
86+
87+
Note that you cannot disable CMK on existing Fluid Relay resource once it is enabled.
88+
89+
Request URL:
90+
91+
```
92+
PATCH https://management.azure.com/subscriptions/<subscription id>/resourceGroups/<resource group name>/providers/Microsoft.FluidRelay/fluidRelayServers/<fluid relay server name>?api-version=2022-06-01 @"path to request payload"
93+
```
94+
95+
Request payload example for updating key encryption key URL:
96+
97+
```
98+
{
99+
"properties": {
100+
"encryption": {
101+
"customerManagedKeyEncryption": {
102+
"keyEncryptionKeyUrl": "https://test_key_vault.vault.azure.net/keys/testKey /xxxxxxxxxxxxxxxx"
103+
}
104+
}
105+
}
106+
}
107+
```
108+
109+
## See also
110+
111+
- [Overview of Azure Fluid Relay architecture](architecture.md)
112+
- [Data storage in Azure Fluid Relay](../concepts/data-storage.md)
113+
- [Data encryption in Azure Fluid Relay](../concepts/data-encryption.md)

‎articles/azure-fluid-relay/concepts/data-encryption.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Microsoft has a set of internal guidelines for encryption key rotation which Azu
3535

3636
### Can I use my own encryption keys?
3737

38-
No, this feature is not available yet. Keep an eye out for more updates on this.
38+
Yes. For more information, refer to [Customer-managed keys for Azure Fluid Relay encryption](../concepts/customer-managed-keys.md).
3939

4040
### What regions have encryption turned on?
4141

0 commit comments

Comments
 (0)