Merge pull request #231568 from schaffererin/aks-kv-access

adding note per gh feedback regarding proper permissions to ensure access to key vault keys

Author: prmerger-automator[bot]

articles/aks/enable-host-encryption.md

@@ -34,7 +34,7 @@ This feature can only be set at cluster creation or node pool creation time.
 
 ## Use host-based encryption on new clusters
 
-Configure the cluster agent nodes to use host-based encryption when the cluster is created. 
+Configure the cluster agent nodes to use host-based encryption when the cluster is created.
 
 ```azurecli-interactive
 az aks create --name myAKSCluster --resource-group myResourceGroup -s Standard_DS2_v2 -l westus2 --enable-encryption-at-host
@@ -52,12 +52,13 @@ az aks nodepool add --name hostencrypt --cluster-name myAKSCluster --resource-gr
 
 If you want to create new node pools without the host-based encryption feature, you can do so by omitting the `--enable-encryption-at-host` parameter.
 
-## Next steps
-
-Review [best practices for AKS cluster security][best-practices-security]
-Read more about [host-based encryption](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data).
+> [!NOTE]
+> After you enable host-based encryption on your cluster, make sure you provide the proper access to your Azure Key Vault to enable encryption at rest. For more information, see [Control access][control-keys] and [Azure built-in roles for Key Vault data plane operations][akv-built-in-roles].
 
+## Next steps
 
+- Review [best practices for AKS cluster security][best-practices-security].
+- Read more about [host-based encryption](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data).
 <!-- LINKS - external -->
 
 <!-- LINKS - internal -->
@@ -70,3 +71,5 @@ Read more about [host-based encryption](../virtual-machines/disk-encryption.md#e
 [az-feature-register]: /cli/azure/feature#az_feature_register
 [az-feature-list]: /cli/azure/feature#az_feature_list
 [az-provider-register]: /cli/azure/provider#az_provider_register
+[control-keys]: ../key-vault/general/best-practices.md#control-access-to-your-vault
+[akv-built-in-roles]: ../key-vault/general/rbac-guide.md#azure-built-in-roles-for-key-vault-data-plane-operations