Skip to content

Commit 61204d7

Browse files
tiburdtiburd
authored
Merge pull request #96741 from tamram/tamram-1120
add encryption FAQ content
2 parents d82f3c1 + a4aa1d4 commit 61204d7

15 files changed

+378
-121
lines changed

‎articles/storage/blobs/TOC.yml

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -334,14 +334,24 @@
334334
href: ../common/storage-account-sas-create-dotnet.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
335335
- name: Define a stored access policy
336336
href: ../common/storage-stored-access-policy-define-dotnet.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
337-
- name: Use customer-managed keys for encryption
337+
- name: Manage Azure Storage encryption
338338
items:
339-
- name: Portal
340-
href: ../common/storage-encryption-keys-portal.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
341-
- name: PowerShell
342-
href: ../common/storage-encryption-keys-powershell.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
343-
- name: Azure CLI
344-
href: ../common/storage-encryption-keys-cli.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
339+
- name: Check whether a blob is encrypted
340+
href: storage-blob-encryption-status.md
341+
- name: Manage encryption keys for the storage account
342+
items:
343+
- name: Check the encryption key model for the account
344+
href: ../common/storage-encryption-key-model-get.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
345+
- name: Configure customer-managed encryption keys
346+
items:
347+
- name: Portal
348+
href: ../common/storage-encryption-keys-portal.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
349+
- name: PowerShell
350+
href: ../common/storage-encryption-keys-powershell.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
351+
- name: Azure CLI
352+
href: ../common/storage-encryption-keys-cli.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json
353+
- name: Provide an encryption key on a request
354+
href: storage-blob-customer-provided-key.md
345355
- name: Configure client-side encryption
346356
items:
347357
- name: .NET

‎articles/storage/blobs/media/storage-blob-encryption-status/blob-encryption-property-portal.png

35.9 KB
Loading

‎articles/storage/blobs/storage-blob-customer-provided-key.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
title: Specify a customer-provided key on a request to Blob storage with .NET - Azure Storage
3+
description: Learn how to specify a customer-provided key on a request to Blob storage using .NET.
4+
services: storage
5+
author: tamram
6+
7+
ms.service: storage
8+
ms.topic: how-to
9+
ms.date: 11/26/2019
10+
ms.author: tamram
11+
ms.reviewer: cbrooks
12+
ms.subservice: common
13+
---
14+
15+
# Specify a customer-provided key on a request to Blob storage with .NET
16+
17+
Clients making requests against Azure Blob storage have the option to provide an encryption key on an individual request. Including the encryption key on the request provides granular control over encryption settings for Blob storage operations. Customer-provided keys (preview) can be stored in Azure Key Vault or in another key store.
18+
19+
This article shows how to specify a customer-provided key on a request with .NET.
20+
21+
[!INCLUDE [storage-install-packages-blob-and-identity-include](../../../includes/storage-install-packages-blob-and-identity-include.md)]
22+
23+
## Example: Use a customer-provided key to upload a blob
24+
25+
The following example creates a customer-provided key and uses that key to upload a blob. The code uploads a block, then commits the block list to write the blob to Azure Storage.
26+
27+
```csharp
28+
async static Task UploadBlobWithClientKey(string accountName, string containerName,
29+
string blobName, Stream data, byte[] key)
30+
{
31+
const string blobServiceEndpointSuffix = ".blob.core.windows.net";
32+
Uri accountUri = new Uri("https://" + accountName + blobServiceEndpointSuffix);
33+
34+
// Specify the customer-provided key on the options for the client.
35+
BlobClientOptions options = new BlobClientOptions()
36+
{
37+
CustomerProvidedKey = new CustomerProvidedKey(key)
38+
};
39+
40+
// Create a client object for the Blob service, including options.
41+
BlobServiceClient serviceClient = new BlobServiceClient(accountUri,
42+
new DefaultAzureCredential(), options);
43+
44+
// Create a client object for the container.
45+
// The container client retains the credential and client options.
46+
BlobContainerClient containerClient = serviceClient.GetBlobContainerClient(containerName);
47+
48+
// Create a new block blob client object.
49+
// The blob client retains the credential and client options.
50+
BlobClient blobClient = containerClient.GetBlobClient(blobName);
51+
52+
try
53+
{
54+
// Create the container if it does not exist.
55+
await containerClient.CreateIfNotExistsAsync();
56+
57+
// Upload the data using the customer-provided key.
58+
await blobClient.UploadAsync(data);
59+
}
60+
catch (RequestFailedException e)
61+
{
62+
Console.WriteLine(e.Message);
63+
Console.ReadLine();
64+
throw;
65+
}
66+
}
67+
```
68+
69+
## Next steps
70+
71+
- [Azure Storage encryption for data at rest](../common/storage-service-encryption.md)
72+
- [Authorize access to blobs and queues with Azure Active Directory and managed identities for Azure Resources](../common/storage-auth-aad-msi.md)

‎articles/storage/blobs/storage-blob-encryption-status.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
title: Check the encryption status of a blob - Azure Storage
3+
description: Learn how to use Azure portal, PowerShell, or Azure CLI to check whether a given blob is encrypted. If a blob is not encrypted, learn how to use AzCopy to force encryption by downloading and re-uploading the blob.
4+
services: storage
5+
author: tamram
6+
7+
ms.service: storage
8+
ms.topic: how-to
9+
ms.date: 11/26/2019
10+
ms.author: tamram
11+
ms.reviewer: cbrooks
12+
ms.subservice: common
13+
---
14+
15+
# Check the encryption status of a blob
16+
17+
Every block blob, append blob, or page blob that was written to Azure Storage after October 20, 2017 is encrypted with Azure Storage encryption. Blobs created prior to this date continue to be encrypted by a background process.
18+
19+
This article shows how to determine whether a given blob has been encrypted.
20+
21+
## Check a blob's encryption status
22+
23+
Use the Azure portal, PowerShell, or Azure CLI to determine whether a blob is encrypted without code.
24+
25+
### [Azure portal](#tab/portal)
26+
27+
To use the Azure portal to check whether a blob has been encrypted, follow these steps:
28+
29+
1. In the Azure portal, navigate to your storage account.
30+
1. Select **Containers** to navigate to a list of containers in the account.
31+
1. Locate the blob and display its **Overview** tab.
32+
1. View the **Server Encrypted** property. If **True**, as shown in the following image, then the blob is encrypted. Notice that the blob's properties also include the date and time that the blob was created.
33+
34+
![Screenshot showing how to check Server Encrypted property in Azure portal](media/storage-blob-encryption-status/blob-encryption-property-portal.png)
35+
36+
### [PowerShell](#tab/powershell)
37+
38+
To use PowerShell to check whether a blob has been encrypted, check the blob's **IsServerEncrypted** property. Remember to replace placeholder values in angle brackets with your own values:
39+
40+
```powershell
41+
$account = Get-AzStorageAccount -ResourceGroupName <resource-group> `
42+
-Name <storage-account>
43+
$blob = Get-AzStorageBlob -Context $account.Context `
44+
-Container <container> `
45+
-Blob <blob>
46+
$blob.ICloudBlob.Properties.IsServerEncrypted
47+
```
48+
49+
To determine when the blob was created, check the value of the **Created** property:
50+
51+
```powershell
52+
$blob.ICloudBlob.Properties.IsServerEncrypted
53+
```
54+
55+
### [Azure CLI](#tab/cli)
56+
57+
To use Azure CLI to check whether a blob has been encrypted, check the blob's **IsServerEncrypted** property. Remember to replace placeholder values in angle brackets with your own values:
58+
59+
```azurecli-interactive
60+
az storage blob show \
61+
--account-name <storage-account> \
62+
--container-name <container> \
63+
--name <blob> \
64+
--query "properties.serverEncrypted"
65+
```
66+
67+
To determine when the blob was created, check the value of the **created** property.
68+
69+
---
70+
71+
### Force encryption of a blob
72+
73+
If a blob that was created prior to October 20, 2017 has not yet been encrypted by the background process, you can force encryption to occur immediately by downloading and re-uploading the blob. A simple way to do this is with AzCopy.
74+
75+
To download a blob to your local file system with AzCopy, use the following syntax:
76+
77+
```
78+
azcopy copy 'https://<storage-account-name>.<blob or dfs>.core.windows.net/<container-name>/<blob-path>' '<local-file-path>'
79+
80+
Example:
81+
azcopy copy 'https://storagesamples.blob.core.windows.net/sample-container/blob1.txt' 'C:\temp\blob1.txt'
82+
```
83+
84+
To re-upload the blob to Azure Storage with AzCopy, use the following syntax:
85+
86+
```
87+
azcopy copy '<local-file-path>' 'https://<storage-account-name>.<blob or dfs>.core.windows.net/<container-name>/<blob-name>'
88+
89+
Example:
90+
azcopy copy 'C:\temp\blob1.txt' 'https://storagesamples.blob.core.windows.net/sample-container/blob1.txt'
91+
```
92+
93+
For more information about using AzCopy to copy blob data, see [Transfer data with AzCopy and Blob storage](../common/storage-use-azcopy-blobs.md).
94+
95+
## Next steps
96+
97+
[Azure Storage encryption for data at rest](../common/storage-service-encryption.md)

‎articles/storage/common/media/storage-encryption-key-model-get/customer-managed-encryption-key-setting-portal.png

44.1 KB
Loading

‎articles/storage/common/storage-auth-aad-msi.md

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -99,19 +99,7 @@ The Azure Identity client library reads values from three environment variables
9999
100100
For more information, see [Create identity for Azure app in portal](../../active-directory/develop/howto-create-service-principal-portal.md).
101101

102-
## Install client library packages
103-
104-
The examples in this article use the latest version of the Azure Storage client library for Blob storage. To install the package, run the following command from the NuGet package manager console:
105-
106-
```powershell
107-
Install-Package Azure.Storage.Blobs
108-
```
109-
110-
The examples in this article also use the latest version of the [Azure Identity client library for .NET](https://www.nuget.org/packages/Azure.Identity/) to authenticate with Azure AD credentials. To install the package, run the following command from the NuGet package manager console:
111-
112-
```powershell
113-
Install-Package Azure.Identity
114-
```
102+
[!INCLUDE [storage-install-packages-blob-and-identity-include](../../../includes/storage-install-packages-blob-and-identity-include.md)]
115103

116104
## .NET code example: Create a block blob
117105

‎articles/storage/common/storage-auth.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,13 @@ Each authorization option is briefly described below:
3232

3333
- **Azure AD Domain Services (DS) integration (preview)** for files. Azure Files supports identity-based authentication over Server Message Block (SMB) through Azure AD DS. This provides RBAC for fine-grained control over a client's access to resources in a storage account. For more information regarding Azure AD integration for files using domain services, see [Overview of Azure Files Azure Active Directory Domain Service (AAD DS) Authentication Support for SMB Access (preview)](../files/storage-files-active-directory-overview.md).
3434

35-
- **Shared Key authorization** for blobs, files, queues, and tables. A client using Shared Key passes a header with every request that is signed using the storage account access key. For more information, see [Authorize with Shared Key](https://docs.microsoft.com/rest/api/storageservices/authenticate-with-shared-key/).
35+
- **Shared Key authorization** for blobs, files, queues, and tables. A client using Shared Key passes a header with every request that is signed using the storage account access key. For more information, see [Authorize with Shared Key](/rest/api/storageservices/authenticate-with-shared-key/).
3636
- **Shared access signatures** for blobs, files, queues, and tables. Shared access signatures (SAS) provide limited delegated access to resources in a storage account. Adding constraints on the time interval for which the signature is valid or on permissions it grants provides flexibility in managing access. For more information, see [Using shared access signatures (SAS)](storage-sas-overview.md).
3737
- **Anonymous public read access** for containers and blobs. Authorization is not required. For more information, see [Manage anonymous read access to containers and blobs](../blobs/storage-manage-access-to-resources.md).
3838

39-
By default, all resources in Azure Storage are secured, and are available only to the account owner. Although you can use any of the authorization strategies outlined above to grant clients access to resources in your storage account, Microsoft recommends using Azure AD when possible for maximum security and ease of use.
39+
By default, all resources in Azure Storage are secured, and are available only to the account owner. Although you can use any of the authorization strategies outlined above to grant clients access to resources in your storage account, Microsoft recommends using Azure AD when possible for maximum security and ease of use.
40+
41+
## Next steps
42+
43+
- [Azure Active Directory documentation](/azure/active-directory/)
44+
- [Evolution of Microsoft identity platform](/azure/active-directory/develop/about-microsoft-identity-platform)

‎articles/storage/common/storage-encryption-key-model-get.md

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
title: Determine which encryption key model is in use for the storage account - Azure Storage
3+
description: Use Azure portal, PowerShell, or Azure CLI to check how encryption keys are being managed for the storage account. Keys may be managed by Microsoft (the default), or by the customer. Customer-managed keys must be stored in Azure Key Vault.
4+
services: storage
5+
author: tamram
6+
7+
ms.service: storage
8+
ms.topic: how-to
9+
ms.date: 11/26/2019
10+
ms.author: tamram
11+
ms.reviewer: cbrooks
12+
ms.subservice: common
13+
---
14+
15+
# Determine which Azure Storage encryption key model is in use for the storage account
16+
17+
Data in your storage account is automatically encrypted by Azure Storage. Azure Storage encryption offers two options for managing encryption keys at the level of the storage account:
18+
19+
- **Microsoft-managed keys.** By default, Microsoft manages the keys used to encrypt your storage account.
20+
- **Customer-managed keys.** You can optionally choose to manage encryption keys for your storage account. Customer-managed keys must be stored in Azure Key Vault.
21+
22+
Additionally, you can provide an encryption key at the level of an individual request for some Blob storage operations. When an encryption key is specified on the request, that key overrides the encryption key that is active on the storage account. For more information, see [Specify a customer-provided key on a request to Blob storage](../blobs/storage-blob-customer-provided-key.md).
23+
24+
For more information about encryption keys, see [Azure Storage encryption for data at rest](storage-service-encryption.md).
25+
26+
## Check the encryption key model for the storage account
27+
28+
To determine whether a storage account is using Microsoft-managed keys or customer-managed keys for encryption, use one of the following approaches.
29+
30+
# [Azure portal](#tab/portal)
31+
32+
To check the encryption model for the storage account by using the Azure portal, follow these steps:
33+
34+
1. In the Azure portal, navigate to your storage account.
35+
1. Select the **Encryption** setting and note the setting.
36+
37+
The following image shows a storage account where customer-managed keys are in use for encryption:
38+
39+
![Screenshot showing encryption key setting in Azure portal](media/storage-encryption-key-model-get/customer-managed-encryption-key-setting-portal.png)
40+
41+
# [PowerShell](#tab/powershell)
42+
43+
To check the encryption model for the storage account by using PowerShell, call the [Get-AzStorageAccount](/powershell/module/az.storage/get-azstorageaccount) command, then check the **KeySource** property for the account.
44+
45+
```powershell
46+
$account = Get-AzStorageAccount -ResourceGroupName <resource-group> `
47+
-Name <storage-account>
48+
$account.Encryption.KeySource
49+
```
50+
51+
If the value of the **KeySource** property is `Microsoft.Storage`, then the account is encrypted with Microsoft-managed keys. If the value of the **KeySource** property is `Microsoft.Keyvault`, then the account is encrypted with customer-managed keys.
52+
53+
# [Azure CLI](#tab/cli)
54+
55+
To check the encryption model for the storage account by using Azure CLI, call the [az storage account show](/cli/azure/storage/account#az-storage-account-show) command, then check the **keySource** property for the account.
56+
57+
```azurecli-interactive
58+
key_source=$(az storage account show \
59+
--name <storage-account> \
60+
--resource-group <resource-group> \
61+
--query encryption.keySource \
62+
--output tsv)
63+
```
64+
65+
If the value of the **keySource** property is `Microsoft.Storage`, then the account is encrypted with Microsoft-managed keys. If the value of the **keySource** property is `Microsoft.Keyvault`, then the account is encrypted with customer-managed keys.
66+
67+
---
68+
69+
## Next steps
70+
71+
[Azure Storage encryption for data at rest](storage-service-encryption.md)

‎articles/storage/common/storage-encryption-keys-cli.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
---
2-
title: Configure customer-managed keys for Azure Storage encryption from Azure CLI
3-
description: Learn how to use Azure CLI to configure customer-managed keys for Azure Storage encryption. Customer-managed keys enable you to create, rotate, disable, and revoke access controls.
2+
title: Configure customer-managed keys with Azure Key Vault by using Azure CLI - Azure Storage
3+
description: Learn how to use Azure CLI to configure customer-managed keys with Azure Key Vault for Azure Storage encryption. Customer-managed keys enable you to create, rotate, disable, and revoke access controls.
44
services: storage
55
author: tamram
66

77
ms.service: storage
8-
ms.topic: conceptual
9-
ms.date: 10/15/2019
8+
ms.topic: how-to
9+
ms.date: 11/20/2019
1010
ms.author: tamram
1111
ms.reviewer: cbrooks
1212
ms.subservice: common
1313
---
1414

15-
# Configure customer-managed keys for Azure Storage encryption from Azure CLI
15+
# Configure customer-managed keys for Azure Storage by using Azure CLI
1616

1717
[!INCLUDE [storage-encryption-configure-keys-include](../../../includes/storage-encryption-configure-keys-include.md)]
1818

19-
This article shows how to configure a key vault with customer-managed keys using Azure CLI.
19+
This article shows how to configure an Azure Key Vault with customer-managed keys using Azure CLI. To learn how to create a key vault using Azure CLI, see [Quickstart: Set and retrieve a secret from Azure Key Vault using Azure CLI](../../key-vault/quick-create-cli.md).
2020

2121
> [!IMPORTANT]
2222
> Using customer-managed keys with Azure Storage encryption requires that two properties be set on the key vault, **Soft Delete** and **Do Not Purge**. These properties are not enabled by default. To enable these properties, use either PowerShell or Azure CLI.

‎articles/storage/common/storage-encryption-keys-portal.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
---
2-
title: Configure customer-managed keys for Azure Storage encryption from the Azure portal
3-
description: Learn how to use the Azure portal to configure customer-managed keys for Azure Storage encryption. Customer-managed keys enable you to create, rotate, disable, and revoke access controls.
2+
title: Configure customer-managed keys with Azure Key Vault by using the Azure portal - Azure Storage
3+
description: Learn how to use the Azure portal to configure customer-managed keys with Azure Key Vault for Azure Storage encryption. Customer-managed keys enable you to create, rotate, disable, and revoke access controls.
44
services: storage
55
author: tamram
66

77
ms.service: storage
8-
ms.topic: article
9-
ms.date: 10/15/2019
8+
ms.topic: how-to
9+
ms.date: 11/20/2019
1010
ms.author: tamram
1111
ms.reviewer: cbrooks
1212
ms.subservice: common
1313
---
1414

15-
# Configure customer-managed keys for Azure Storage encryption from the Azure portal
15+
# Configure customer-managed keys for Azure Storage by using the Azure portal
1616

1717
[!INCLUDE [storage-encryption-configure-keys-include](../../../includes/storage-encryption-configure-keys-include.md)]
1818

19-
This article shows how to configure a key vault with customer-managed keys using the [Azure portal](https://portal.azure.com/). To learn how to create a key vault using the Azure portal, see [Quickstart: Set and retrieve a secret from Azure Key Vault using the Azure portal](../../key-vault/quick-create-portal.md).
19+
This article shows how to configure an Azure Key Vault with customer-managed keys using the [Azure portal](https://portal.azure.com/). To learn how to create a key vault using the Azure portal, see [Quickstart: Set and retrieve a secret from Azure Key Vault using the Azure portal](../../key-vault/quick-create-portal.md).
2020

2121
> [!IMPORTANT]
2222
> Using customer-managed keys with Azure Storage encryption requires that two properties be set on the key vault, **Soft Delete** and **Do Not Purge**. These properties are not enabled by default. To enable these properties, use either PowerShell or Azure CLI.

0 commit comments

Comments
 (0)