You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/key-vault/general/developers-guide.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,14 +6,14 @@ author: msmbaldwin
6
6
ms.service: key-vault
7
7
ms.subservice: general
8
8
ms.topic: how-to
9
-
ms.date: 10/05/2020
9
+
ms.date: 01/17/2023
10
10
ms.author: mbaldwin
11
11
---
12
12
# Azure Key Vault developer's guide
13
13
14
14
Azure Key Vault allows you to securely access sensitive information from within your applications:
15
15
16
-
- Keys, secrets, and certificates are protected without your having to write the code yourself, and you can easily use them from your applications.
16
+
- Keys, secrets, and certificates are protected without you're having to write the code yourself, and you can easily use them from your applications.
17
17
- You allow customers to own and manage their own keys, secrets, and certificates so you can concentrate on providing the core software features. In this way, your applications won't own the responsibility or potential liability for your customers' tenant keys, secrets, and certificates.
18
18
- Your application can use keys for signing and encryption yet keep the key management external from your application. For more information, see [About keys](../keys/about-keys.md).
19
19
- You can manage credentials like passwords, access keys, and SAS tokens by storing them in Key Vault as secrets. For more information, see [About secrets](../secrets/about-secrets.md).
@@ -37,7 +37,7 @@ You can use the predefined Key Vault Contributor role to grant management access
Copy file name to clipboardExpand all lines: articles/key-vault/general/disaster-recovery-guidance.md
+32-11Lines changed: 32 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,32 +7,47 @@ author: msmbaldwin
7
7
ms.service: key-vault
8
8
ms.subservice: general
9
9
ms.topic: tutorial
10
-
ms.date: 03/31/2021
10
+
ms.date: 01/17/2023
11
11
ms.author: mbaldwin
12
+
ms.custom: references_regions
12
13
13
14
---
14
15
# Azure Key Vault availability and redundancy
15
16
16
17
Azure Key Vault features multiple layers of redundancy to make sure that your keys and secrets remain available to your application even if individual components of the service fail.
17
18
18
19
> [!NOTE]
19
-
> This guide applies to vaults. Managed HSM pools use a different high availability and disaster recovery model. See[Managed HSM Disaster Recovery Guide](../managed-hsm/disaster-recovery-guide.md) for more information.
20
+
> This guide applies to vaults. Managed HSM pools use a different high availability and disaster recovery model; for more information, see[Managed HSM Disaster Recovery Guide](../managed-hsm/disaster-recovery-guide.md) for more information.
20
21
21
-
The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. For details about specific region pairs, see [Azure paired regions](../../availability-zones/cross-region-replication-azure.md). The exception to the paired regions model is single region geo, for example Brazil South, Qatar Central. Such regions allow only the option to keep data resident within the same region. Both Brazil South and Qatar Central use zone redundant storage (ZRS) to replicate your data three times within the single location/region. For AKV Premium, only 2 of the 3 regions are used to replicate data from the HSM's.
22
+
The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. For details about specific region pairs, see [Azure paired regions](../../availability-zones/cross-region-replication-azure.md). The exception to the paired regions model is single region geo, for example Brazil South, Qatar Central. Such regions allow only the option to keep data resident within the same region. Both Brazil South and Qatar Central use zone redundant storage (ZRS) to replicate your data three times within the single location/region. For AKV Premium, only two of the three regions are used to replicate data from the HSMs.
22
23
23
-
If individual components within the key vault service fail, alternate components within the region step in to serve your request to make sure that there is no degradation of functionality. You don't need to take any action to start this process, it happens automatically and will be transparent to you.
24
+
If individual components within the key vault service fail, alternate components within the region step in to serve your request to make sure that there's no degradation of functionality. You don't need to take any action—the process happens automatically and will be transparent to you.
24
25
25
-
In the rare event that an entire Azure region is unavailable, the requests that you make of Azure Key Vault in that region are automatically routed (*failed over*) to a secondary region except in the case of the Brazil South and Qatar Central region. When the primary region is available again, requests are routed back (*failed back*) to the primary region. Again, you don't need to take any action because this happens automatically.
26
+
## Failover
26
27
27
-
In the Brazil South and Qatar Central region, you must plan for the recovery of your Azure key vaults in a region failure scenario. To back up and restore your Azure key vault to a region of your choice, complete the steps that are detailed in [Azure Key Vault backup](backup.md).
28
+
In the rare event that an entire Azure region is unavailable, the requests that you make of Azure Key Vault in that region are automatically routed (*failed over*) to a secondary region (except as noted). When the primary region is available again, requests are routed back (*failed back*) to the primary region. Again, you don't need to take any action because this happens automatically.
29
+
30
+
> [!IMPORTANT]
31
+
> Failover is not supported in:
32
+
>
33
+
> - Brazil South
34
+
> - Brazil Southeast
35
+
> - Qatar Central (no paired region)
36
+
> - Poland Central (no paired region)
37
+
> - West US 3
38
+
>
39
+
> All other regions use read-access geo-redundant storage (RA-GRS). For more information, see [Azure Storage redundancy: Redundancy in a secondary region](../../storage/common/storage-redundancy.md#redundancy-in-a-secondary-region).
40
+
41
+
In the Brazil South and Qatar Central region, you must plan for the recovery of your Azure key vaults in a region failure scenario. To back up and restore your Azure key vault to a region of your choice, complete the steps that are detailed in [Azure Key Vault backup](backup.md).
28
42
29
43
Through this high availability design, Azure Key Vault requires no downtime for maintenance activities.
30
44
31
45
There are a few caveats to be aware of:
32
46
33
-
* In the event of a region failover, it may take a few minutes for the service to fail over. Requests that are made during this time before failover may fail.
34
-
* If you are using private link to connect to your key vault, it may take up to 20 minutes for the connection to be re-established in the event of a failover.
35
-
* During failover, your key vault is in read-only mode. Requests that are supported in this mode are:
47
+
* In the event of a region failover, it may take a few minutes for the service to fail over. Requests made during this time before failover may fail.
48
+
* If you're using private link to connect to your key vault, it may take up to 20 minutes for the connection to be re-established in the event of a failover.
49
+
* During failover, your key vault is in read-only mode. Requests supported in this mode:
50
+
36
51
* List certificates
37
52
* Get certificates
38
53
* List secrets
@@ -47,6 +62,12 @@ There are a few caveats to be aware of:
47
62
* Sign
48
63
* Backup
49
64
50
-
* During failover, you will not be able to make changes to key vault properties. You will not be able to change access policy or firewall configurations and settings.
65
+
During failover, you won't be able to make changes to key vault properties. You won't be able to change access policy or firewall configurations and settings.
66
+
67
+
After a failover is failed back, all request types (including read *and* write requests) are available.
68
+
69
+
## Next steps
51
70
52
-
* After a failover is failed back, all request types (including read *and* write requests) are available.
description: Resolve common private links issues with Key Vault and deep dive into the configuration
4
4
author: msfcolombo
5
5
ms.author: fcolombo
6
-
ms.date: 09/30/2020
6
+
ms.date: 01/17/2023
7
7
ms.service: key-vault
8
8
ms.subservice: general
9
9
ms.topic: how-to
@@ -49,17 +49,17 @@ If the application, script or portal is running on an arbitrary Internet-connect
49
49
50
50
### If you use a managed solution, refer to specific documentation
51
51
52
-
This guide is NOT applicable to solutions that are managed by Microsoft, where the key vault is accessed by an Azure product that exists independently from the customer Virtual Network. Examples of such scenarios are Azure Storage or Azure SQL configured for encryption at rest, Azure Event Hub encrypting data with customer-provided keys, Azure Data Factory accessing service credentials stored in key vault, Azure Pipelines retrieving secrets from key vault, and other similar scenarios. In these cases, *you must check if the product supports key vaults with the firewall enabled*. This support is typically performed with the [Trusted Services](overview-vnet-service-endpoints.md#trusted-services) feature of Key Vault firewall. However, many products are not included in the list of trusted services, for a variety of reasons. In that case, reach the product-specific support.
52
+
This guide is NOT applicable to solutions that are managed by Microsoft, where the key vault is accessed by an Azure product that exists independently from the customer Virtual Network. Examples of such scenarios are Azure Storage or Azure SQL configured for encryption at rest, Azure Event Hubs encrypting data with customer-provided keys, Azure Data Factory accessing service credentials stored in key vault, Azure Pipelines retrieving secrets from key vault, and other similar scenarios. In these cases, *you must check if the product supports key vaults with the firewall enabled*. This support is typically performed with the [Trusted Services](overview-vnet-service-endpoints.md#trusted-services) feature of Key Vault firewall. However, many products are not included in the list of trusted services, for various reasons. In that case, reach the product-specific support.
53
53
54
-
A small number of Azure products supports the concept of *vnet injection*. In simple terms, the product adds a network device into the customer Virtual Network, allowing it to send requests as if was deployed to the Virtual Network. A notable example is [Azure Databricks](/azure/databricks/administration-guide/cloud-configurations/azure/vnet-inject). Products like this can make requests to the key vault using the private links, and this troubleshooting guide may help.
54
+
A few Azure products supports the concept of *vnet injection*. In simple terms, the product adds a network device into the customer Virtual Network, allowing it to send requests as if it was deployed to the Virtual Network. A notable example is [Azure Databricks](/azure/databricks/administration-guide/cloud-configurations/azure/vnet-inject). Products like this can make requests to the key vault using the private links, and this troubleshooting guide may help.
55
55
56
56
## 2. Confirm that the connection is approved and succeeded
57
57
58
58
The following steps validate that the private endpoint connection is approved and succeeded:
59
59
60
60
1. Open the Azure portal and open your key vault resource.
61
61
2. In the left menu, select **Networking**.
62
-
3.Click the **Private endpoint connections** tab. This will show all private endpoint connections and their respective states. If there are no connections, or if the connection for your Virtual Network is missing, you have to create a new Private Endpoint. This will be covered later.
62
+
3.Select the **Private endpoint connections** tab. This will show all private endpoint connections and their respective states. If there are no connections, or if the connection for your Virtual Network is missing, you have to create a new Private Endpoint. This will be covered later.
63
63
4. Still in **Private endpoint connections**, find the one you are diagnosing and confirm that "Connection state" is **Approved** and "Provisioning state" is **Succeeded**.
64
64
- If the connection is in "Pending" state, you might be able to just approve it.
65
65
- If the connection "Rejected", "Failed", "Error", "Disconnected" or other state, then it's not effective at all, you have to create a new Private Endpoint resource.
@@ -116,7 +116,7 @@ You will need to diagnose hostname resolution, and for that you must know the ex
116
116
117
117
1. Open the Azure portal and open your key vault resource.
118
118
2. In the left menu, select **Networking**.
119
-
3.Click the **Private endpoint connections** tab. This will show all private endpoint connections and their respective states.
119
+
3.Select the **Private endpoint connections** tab. This will show all private endpoint connections and their respective states.
120
120
4. Find the one you are diagnosing and confirm that "Connection state" is **Approved** and Provisioning state is **Succeeded**. If you are not seeing this, go back to previous sections of this document.
121
121
5. When you find the right item, click the link in the **Private endpoint** column. This will open the Private Endpoint resource.
122
122
6. The Overview page may show a section called **Custom DNS settings**. Confirm that there is only one entry that matches the key vault hostname. That entry shows the key vault private IP address.
0 commit comments