Skip to content

Commit 39a4754

Browse files
authored
Merge pull request #126995 from changeworld/patch-10
Fix typo: requestor -> requester
2 parents e7c0f66 + b50a0c2 commit 39a4754

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/azure-government/azure-secure-isolation-guidance.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ When you create a key vault in a resource group, you can [manage access](/azure/
174174
#### Managed HSM
175175
**[Managed HSM](/azure/key-vault/managed-hsm/overview)** provides a single-tenant, fully managed, highly available, zone-resilient (where available) HSM as a service to store and manage your cryptographic keys. It's most suitable for applications and usage scenarios that handle high value keys. It also helps you meet the most stringent security, compliance, and regulatory requirements. Managed HSM uses [FIPS 140 Level 3 validated HSMs](/azure/compliance/offerings/offering-fips-140-2) to protect your cryptographic keys. Each managed HSM pool is an isolated single-tenant instance with its own [security domain](/azure/key-vault/managed-hsm/security-domain) controlled by you and isolated cryptographically from instances belonging to other customers. Cryptographic isolation relies on [Intel Software Guard Extensions](https://software.intel.com/sgx) (SGX) technology that provides encrypted code and data to help ensure your control over cryptographic keys.
176176

177-
When a managed HSM is created, the requestor also provides a list of data plane administrators. Only these administrators are able to [access the managed HSM data plane](/azure/key-vault/managed-hsm/access-control) to perform key operations and manage data plane role assignments (managed HSM local RBAC). The permission model for both the management and data planes uses the same syntax, but permissions are enforced at different levels, and role assignments use different scopes. Management plane Azure RBAC is enforced by Azure Resource Manager while data plane-managed HSM local RBAC is enforced by the managed HSM itself.
177+
When a managed HSM is created, the requester also provides a list of data plane administrators. Only these administrators are able to [access the managed HSM data plane](/azure/key-vault/managed-hsm/access-control) to perform key operations and manage data plane role assignments (managed HSM local RBAC). The permission model for both the management and data planes uses the same syntax, but permissions are enforced at different levels, and role assignments use different scopes. Management plane Azure RBAC is enforced by Azure Resource Manager while data plane-managed HSM local RBAC is enforced by the managed HSM itself.
178178

179179
> [!IMPORTANT]
180180
> Unlike with key vaults, granting your users management plane access to a managed HSM doesn't grant them any access to data plane to access keys or data plane role assignments managed HSM local RBAC. This isolation is implemented by design to prevent inadvertent expansion of privileges affecting access to keys stored in managed HSMs.

0 commit comments

Comments
 (0)