You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To register to use the account encryption key with Table storage:
47
+
# [Azure CLI](#tab/azure-cli)
48
+
49
+
To register with Azure CLI, call the [az feature register](/cli/azure/feature#az-feature-register) command.
43
50
44
51
```azurecli
45
-
az feature register --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForTables
52
+
az feature register --namespace Microsoft.Storage \
53
+
--name AllowAccountEncryptionKeyForQueues
54
+
az feature register --namespace Microsoft.Storage \
55
+
--name AllowAccountEncryptionKeyForTables
46
56
```
47
57
58
+
# [Template](#tab/template)
59
+
60
+
N/A
61
+
62
+
---
63
+
48
64
### Check the status of your registration
49
65
50
-
To check the status of your registration for Queue storage:
66
+
To check the status of your registration for Queue or Table storage, use PowerShell or Azure CLI.
51
67
52
-
```azurecli
53
-
az feature show --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForQueues
68
+
# [PowerShell](#tab/powershell)
69
+
70
+
To check the status of your registration with PowerShell, call the [Get-AzProviderFeature](/powershell/module/az.resources/get-azproviderfeature) command.
To check the status of your registration for Table storage:
79
+
# [Azure CLI](#tab/azure-cli)
80
+
81
+
To check the status of your registration with Azure CLI, call the [az feature](/cli/azure/feature#az-feature-show) command.
57
82
58
83
```azurecli
59
-
az feature show --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForTables
84
+
az feature show --namespace Microsoft.Storage \
85
+
--name AllowAccountEncryptionKeyForQueues
86
+
az feature show --namespace Microsoft.Storage \
87
+
--name AllowAccountEncryptionKeyForTables
60
88
```
61
89
90
+
# [Template](#tab/template)
91
+
92
+
N/A
93
+
94
+
---
95
+
62
96
### Re-register the Azure Storage resource provider
63
97
64
-
After your registration is approved, you must re-register the Azure Storage resource provider. Call the [az provider register](/cli/azure/provider#az-provider-register) command:
98
+
After your registration is approved, you must re-register the Azure Storage resource provider. Use PowerShell or Azure CLI to re-register the resource provider.
99
+
100
+
# [PowerShell](#tab/powershell)
101
+
102
+
To re-register the resource provider with PowerShell, call the [Register-AzResourceProvider](/powershell/module/az.resources/register-azresourceprovider) command.
To re-register the resource provider with Azure CLI, call the [az provider register](/cli/azure/provider#az-provider-register) command.
65
111
66
112
```azurecli
67
113
az provider register --namespace 'Microsoft.Storage'
68
114
```
69
115
116
+
# [Template](#tab/template)
117
+
118
+
N/A
119
+
120
+
---
121
+
70
122
## Create an account that uses the account encryption key
71
123
72
124
You must configure a new storage account to use the account encryption key for queues and tables at the time that you create the storage account. The scope of the encryption key cannot be changed after the account is created.
@@ -76,7 +128,28 @@ The storage account must be of type general-purpose v2. You can create the stora
76
128
> [!NOTE]
77
129
> Only Queue and Table storage can be optionally configured to encrypt data with the account encryption key when the storage account is created. Blob storage and Azure Files always use the account encryption key to encrypt data.
78
130
79
-
### [Azure CLI](#tab/azure-cli)
131
+
# [PowerShell](#tab/powershell)
132
+
133
+
To use PowerShell to create a storage account that relies on the account encryption key, make sure you have installed the Azure PowerShell module, version 3.4.0 or later. For more information, see [Install the Azure PowerShell module](/powershell/azure/install-az-ps).
134
+
135
+
Next, create a general-purpose v2 storage account by calling the [New-AzStorageAccount](/powershell/module/az.storage/new-azstorageaccount) command, with the appropriate parameters:
136
+
137
+
- Include the `-EncryptionKeyTypeForQueue` option and set its value to `Account` to use the account encryption key to encrypt data in Queue storage.
138
+
- Include the `-EncryptionKeyTypeForTable` option and set its value to `Account` to use the account encryption key to encrypt data in Table storage.
139
+
140
+
The following example shows how to create a general-purpose v2 storage account that is configured for read-access geo-redundant storage (RA-GRS) and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in brackets with your own values:
To use Azure CLI to create a storage account that relies on the account encryption key, make sure you have installed Azure CLI version 2.0.80 or later. For more information, see [Install the Azure CLI](/cli/azure/install-azure-cli).
82
155
@@ -85,22 +158,22 @@ Next, create a general-purpose v2 storage account by calling the [az storage acc
85
158
- Include the `--encryption-key-type-for-queue` option and set its value to `Account` to use the account encryption key to encrypt data in Queue storage.
86
159
- Include the `--encryption-key-type-for-table` option and set its value to `Account` to use the account encryption key to encrypt data in Table storage.
87
160
88
-
The following example shows how to create a general-purpose v2 storage account that is configured for LRS and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in brackets with your own values:
161
+
The following example shows how to create a general-purpose v2 storage account that is configured for read-access geo-redundant storage (RA-GRS) and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in brackets with your own values:
89
162
90
163
```azurecli
91
164
az storage account create \
92
165
--name <storage-account> \
93
166
--resource-group <resource-group> \
94
167
--location <location> \
95
-
--sku Standard_LRS \
168
+
--sku Standard_RAGRS \
96
169
--kind StorageV2 \
97
170
--encryption-key-type-for-table Account \
98
171
--encryption-key-type-for-queue Account
99
172
```
100
173
101
-
###[Template](#tab/template)
174
+
# [Template](#tab/template)
102
175
103
-
The following JSON example creates a general-purpose v2 storage account that is configured for LRS and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in angle brackets with your own values:
176
+
The following JSON example creates a general-purpose v2 storage account that is configured for read-access geo-redundant storage (RA-GRS) and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in angle brackets with your own values:
104
177
105
178
```json
106
179
"resources": [
@@ -112,7 +185,7 @@ The following JSON example creates a general-purpose v2 storage account that is
112
185
"dependsOn": [],
113
186
"tags": {},
114
187
"sku": {
115
-
"name": "[parameters('Standard_LRS')]"
188
+
"name": "[parameters('Standard_RAGRS')]"
116
189
},
117
190
"kind": "[parameters('StorageV2')]",
118
191
"properties": {
@@ -147,12 +220,33 @@ After you have created an account that relies on the account encryption key, see
147
220
148
221
To verify that a service in a storage account is using the account encryption key, call the Azure CLI [az storage account](/cli/azure/storage/account#az-storage-account-show) command. This command returns a set of storage account properties and their values. Look for the `keyType` field for each service within the encryption property and verify that it is set to `Account`.
149
222
223
+
# [PowerShell](#tab/powershell)
224
+
225
+
To verify that a service in a storage account is using the account encryption key, call the [Get-AzStorageAccount](/powershell/module/az.storage/get-azstorageaccount) command. This command returns a set of storage account properties and their values. Look for the `KeyType` field for each service within the `Encryption` property and verify that it is set to `Account`.
To verify that a service in a storage account is using the account encryption key, call the [az storage account](/cli/azure/storage/account#az-storage-account-show) command. This command returns a set of storage account properties and their values. Look for the `keyType` field for each service within the encryption property and verify that it is set to `Account`.
237
+
150
238
```azurecli
151
239
az storage account show /
152
240
--name <storage-account> /
153
241
--resource-group <resource-group>
154
242
```
155
243
244
+
# [Template](#tab/template)
245
+
246
+
N/A
247
+
248
+
---
249
+
156
250
## Next steps
157
251
158
252
-[Azure Storage encryption for data at rest](storage-service-encryption.md)
0 commit comments