|
| 1 | +--- |
| 2 | +title: Configure customer-managed keys with managed Hardware Security Module for Azure NetApp Files volume encryption |
| 3 | +description: Learn how to encrypt data in Azure NetApp Files with customer-managed keys using the Hardware Security Module |
| 4 | +services: azure-netapp-files |
| 5 | +documentationcenter: '' |
| 6 | +author: b-ahibbard |
| 7 | +manager: '' |
| 8 | +editor: '' |
| 9 | + |
| 10 | +ms.assetid: |
| 11 | +ms.service: azure-netapp-files |
| 12 | +ms.workload: storage |
| 13 | +ms.tgt_pltfrm: na |
| 14 | +ms.topic: how-to |
| 15 | +ms.custom: references_regions |
| 16 | +ms.date: 08/08/2024 |
| 17 | +ms.author: anfdocs |
| 18 | +--- |
| 19 | +# Configure customer-managed keys with managed Hardware Security Module for Azure NetApp Files volume encryption |
| 20 | + |
| 21 | +Azure NetApp Files volume encryption with customer-managed keys with the managed Hardware Security Module (HSM) is an extension to [customer-managed keys for Azure NetApp Files volumes encryption feature](configure-customer-managed-keys.md). Customer-managed keys with HSM allows you to store your encryptions keys in a more secure FIPS 140-2 Level 3 HSM instead of the FIPS 140-2 Level 1 or Level 2 service used by Azure Key Vault (AKV). |
| 22 | + |
| 23 | +## Requirements |
| 24 | + |
| 25 | +* Customer-managed keys with managed HSM is supported using the 2022.11 or later API version. |
| 26 | +* Customer-managed keys with managed HSM is only supported for Azure NetApp Files accounts that don't have existing encryption. |
| 27 | +* Before creating a volume using customer-managed key with managed HSM volume, you must have: |
| 28 | + * created an [Azure Key Vault](/azure/key-vault/general/overview), containing at least one key. |
| 29 | + * The key vault must have soft delete and purge protection enabled. |
| 30 | + * The key must be type RSA. |
| 31 | + * created a VNet with a subnet delegated to Microsoft.Netapp/volumes. |
| 32 | + * a user- or system-assigned identity for your Azure NetApp Files account. |
| 33 | + * [provisioned and activated a managed HSM.](/azure/key-vault/managed-hsm/quick-create-cli) |
| 34 | + |
| 35 | +## Supported regions |
| 36 | + |
| 37 | +* Australia East |
| 38 | +* Brazil South |
| 39 | +* Canada Central |
| 40 | +* Central US |
| 41 | +* East Asia |
| 42 | +* East US |
| 43 | +* East US 2 |
| 44 | +* France Central |
| 45 | +* Japan East |
| 46 | +* Korea Central |
| 47 | +* North Central US |
| 48 | +* North Europe |
| 49 | +* Norway East |
| 50 | +* Norway West |
| 51 | +* South Africa North |
| 52 | +* South Central US |
| 53 | +* Southeast Asia |
| 54 | +* Sweden Central |
| 55 | +* Switzerland North |
| 56 | +* UAE Central |
| 57 | +* UAE North |
| 58 | +* UK South |
| 59 | +* West US |
| 60 | +* West US 2 |
| 61 | +* West US 3 |
| 62 | + |
| 63 | +## Register the feature |
| 64 | + |
| 65 | +This feature is currently in preview. You need to register the feature before using it for the first time. After registration, the feature is enabled and works in the background. No UI control is required. |
| 66 | + |
| 67 | +1. Register the feature: |
| 68 | + |
| 69 | + ```azurepowershell-interactive |
| 70 | + Register-AzProviderFeature -ProviderNamespace Microsoft.NetApp -FeatureName ANFManagedHsmEncryption |
| 71 | + ``` |
| 72 | +
|
| 73 | +2. Check the status of the feature registration: |
| 74 | +
|
| 75 | + > [!NOTE] |
| 76 | + > The **RegistrationState** may be in the `Registering` state for up to 60 minutes before changing to`Registered`. Wait until the status is **Registered** before continuing. |
| 77 | +
|
| 78 | + ```azurepowershell-interactive |
| 79 | + Get-AzProviderFeature -ProviderNamespace Microsoft.NetApp -FeatureName ANFManagedHsmEncryption |
| 80 | + ``` |
| 81 | +You can also use [Azure CLI commands](/cli/azure/feature) `az feature register` and `az feature show` to register the feature and display the registration status. |
| 82 | +
|
| 83 | +## Configure customer-managed keys with managed HSM for system-assigned identity |
| 84 | +
|
| 85 | +When you configure customer-managed keys with a system-assigned identity, Azure configures the NetApp account automatically by adding a system-assigned identity. The access policy is created on your Azure Key Vault with key permissions of Get, Encrypt, and Decrypt. |
| 86 | +
|
| 87 | +### Requirements |
| 88 | +
|
| 89 | +To use a system-assigned identity, the Azure Key Vault must be configured to use Vault access policy as its permission model. Otherwise, you must use a user-assigned identity. |
| 90 | +
|
| 91 | +### Steps |
| 92 | +
|
| 93 | +1. In the Azure portal, navigate to Azure NetApp Files then select **Encryption**. |
| 94 | +1. In the **Encryption** menu, provide the following values: |
| 95 | + * For **Encryption key source**, select **Customer Managed Key**. |
| 96 | + * For **Key URI**, select **Enter Key URI** then provide the URI for the managed HSM. |
| 97 | + * Select the NetApp **Subscription**. |
| 98 | + * For **Identity type**, select **System-assigned**. |
| 99 | +
|
| 100 | + :::image type="content" source="./media/configure-customer-managed-keys/key-enter-uri.png" alt-text="Screenshot of the encryption menu showing key URI field." lightbox="./media/configure-customer-managed-keys//key-enter-uri.png"::: |
| 101 | +
|
| 102 | +1. Select **Save**. |
| 103 | +
|
| 104 | +## Configure customer-managed keys with managed HSM for user-assigned identity |
| 105 | +
|
| 106 | +1. In the Azure portal, navigate to Azure NetApp Files then select **Encryption**. |
| 107 | +1. In the **Encryption** menu, provide the following values: |
| 108 | + * For **Encryption key source**, select **Customer Managed Key**. |
| 109 | + * For **Key URI**, select **Enter Key URI** then provide the URI for the managed HSM. |
| 110 | + * Select the NetApp **Subscription**. |
| 111 | + * For **Identity type**, select **User-assigned**. |
| 112 | +1. When you select **User-assigned**, a context pane opens to select the identity. |
| 113 | + * If your Azure Key Vault is configured to use a Vault access policy, Azure configures the NetApp account automatically and adds the user-assigned identity to your NetApp account. The access policy is created on your Azure Key Vault with key permissions of Get, Encrypt, and Decrypt. |
| 114 | + * If your Azure Key Vault is configured to use Azure role-based access control (RBAC), ensure the selected user-assigned identity has a role assignment on the key vault with permissions for data actions: |
| 115 | + * "Microsoft.KeyVault/vaults/keys/read" |
| 116 | + * "Microsoft.KeyVault/vaults/keys/encrypt/action" |
| 117 | + * "Microsoft.KeyVault/vaults/keys/decrypt/action" |
| 118 | + The user-assigned identity you select is added to your NetApp account. Due to RBAC being customizable, the Azure portal doesn't configure access to the key vault. For more information, see [Using Azure RBAC secret, key, and certificate permissions with Key Vault](/azure/key-vault/general/rbac-guide#using-azure-rbac-secret-key-and-certificate-permissions-with-key-vault) |
| 119 | +
|
| 120 | + :::image type="content" source="./media/configure-customer-managed-keys/encryption-user-assigned.png" alt-text="Screenshot of user-assigned submenu." lightbox="./media/configure-customer-managed-keys/encryption-user-assigned.png"::: |
| 121 | +
|
| 122 | +1. Select **Save**. |
| 123 | +
|
| 124 | +## Next steps |
| 125 | +
|
| 126 | +* [Configure customer-managed keys](configure-customer-managed-keys.md) |
| 127 | +* [Security FAQs](faq-security.md) |
0 commit comments