Skip to content

Commit 8c352ca

Browse files
yossi-yyossi-y
authored
Added modification after I gave it another review and also per feedback from CLL
1 parent 9de8647 commit 8c352ca

File tree

1 file changed

+61
-58
lines changed

1 file changed

+61
-58
lines changed

‎articles/azure-monitor/platform/customer-managed-keys.md

Lines changed: 61 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ with your Key Vault key. The underlay ADX cluster storage uses the
7171
managed identity that\'s associated with the *Cluster* resource to
7272
authenticate and access your Azure Key Vault via Azure Active Directory.
7373

74-
![CMK Overview](media/customer-managed-keys/cmk-overview-8bit.png)
74+
![CMK Overview](media/customer-managed-keys/cmk-overview.png)
7575
1. Customer’s Key Vault.
7676
2. Customer’s Log Analytics Cluster resource having managed identity with permissions to Key Vault – The identity is supported at the data-store (ADX cluster) level.
7777
3. Azure Monitor dedicated ADX cluster.
@@ -128,7 +128,7 @@ For example:
128128

129129
```rst
130130
GET
131-
https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}?api-version=2015-11-01-preview]
131+
https://management.azure.com/subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>?api-version=2015-11-01-preview
132132
Authorization: Bearer eyJ0eXAiO....
133133
```
134134

@@ -170,14 +170,14 @@ This resource is used as intermediate identity connection between your Key Vault
170170
**Create**
171171

172172
```rst
173-
PUT https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters/{cluster-name}?api-version=2019-08-01-preview
173+
PUT https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters/<cluster-name>?api-version=2019-08-01-preview
174174
Authorization: Bearer <token>
175175
Content-type: application/json
176176
177177
{
178-
"location": "region-name",
178+
"location": "<region-name>",
179179
"properties": {
180-
"clusterType": "LogAnalytics" //Should be "ApplicationInsights" for Application Insights CMK
180+
"clusterType": "LogAnalytics" //Should be "ApplicationInsights" for Application Insights CMK
181181
},
182182
"identity": {
183183
"type": "systemAssigned"
@@ -194,36 +194,40 @@ Identity is assigned to the *Cluster* resource at creation time.
194194
"identity": {
195195
"type": "SystemAssigned",
196196
"tenantId": "tenant-id",
197-
"principalId": "principle-id" //A GUID that was generated by the managed identity service
197+
"principalId": "principle-id" //A GUID that was generated by the managed identity service
198198
},
199199
"properties": {
200200
"provisioningState": "Succeeded",
201201
"clusterType": "LogAnalytics",
202-
"clusterId": "cluster-id" //A GUID that Log Analytics generates for the cluster
202+
"clusterId": "cluster-id" //A GUID that Log Analytics generates for the cluster
203203
},
204-
"id": "/subscriptions/subscription-id/resourceGroups/resource-group-name/providers/Microsoft.OperationalInsights/clusters/cluster-name", //The cluster resource Id
204+
"id": "/subscriptions/subscription-id/resourceGroups/resource-group-name/providers/Microsoft.OperationalInsights/clusters/cluster-name", //The cluster resource Id
205205
"name": "cluster-name",
206206
"type": "Microsoft.OperationalInsights/clusters",
207207
"location": "region-name"
208208
}
209209

210210
```
211+
> [!IMPORTANT]
212+
> Copy and keep the "cluster-id" since you will need it in next steps.
211213
212214
If you what to delete the *Cluster* resource for any reason (for example, create it with a different name) use this API call:
213215

214216
```rst
215217
DELETE
216-
https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters/{cluster-name}?api-version=2019-08-01-preview
218+
https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters/<cluster-name>?api-version=2019-08-01-preview
217219
```
218220

219221
### Grant Key Vault permissions
220222

221-
Update your Key Vault and add access policy with 'Get', 'Wrap Key' and
222-
'Unwrap Key' permissions to the *Cluster* resource ID, or *Cluster*
223-
resource name. These permissions will be propagated to the underlaying
224-
Azure Monitor Storage.
223+
Update your Key Vault and add access policy for the Cluster resource. Permissions to your Key Vault are then propagated to the underlaying Azure Monitor Storage to be used for data encryption.
224+
Open your Key Vault in Azure portal and click “Access Policies” then “+ Add Access Policy” to create a new policy with these settings:
225225

226-
![grant Key Vault permissions](media/customer-managed-keys/grant-key-vault-permissions-8bit.png)
226+
- Key permissions: select ‘Get’, ‘Wrap Key’ and ‘Unwrap Key’ permissions.
227+
228+
- Select principal: enter the cluster-id, which is the "clusterId" value in the response of the previous step.
229+
230+
![grant Key Vault permissions](media/customer-managed-keys/grant-key-vault-permissions.png)
227231

228232
The *Get* permission is required to verify that your Key Vault is
229233
configured as recoverable to protect your key and the access to your
@@ -236,10 +240,9 @@ It takes a few minutes until the *Cluster* resource is propagated in
236240

237241
### Update Cluster resource with Key Identifier details
238242

239-
When you create a new version of a key, you need to update the Cluster
240-
resource with Azure Key Vault Key identifier details, to allow Azure
241-
Monitor Storage to use the new version. To get the Key Identifier,
242-
select the current version of your key in Azure Key Vault:
243+
This procedure also applies when you create a new version of a key.
244+
245+
Update the Cluster resource with Azure Key Vault Key identifier details, to allow Azure Monitor Storage to use the new key version. Select the current version of your key in Azure Key Vault to get the Key Identifier details:
243246

244247
![Grant Key Vault permissions](media/customer-managed-keys/key-identifier-8bit.png)
245248

@@ -249,19 +252,19 @@ details.
249252
**Update**
250253

251254
```rst
252-
PUT https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters/{cluster-name}?api-version=2019-08-01-preview
255+
PUT https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters/<cluster-name>?api-version=2019-08-01-preview
253256
Authorization: Bearer <token>
254257
Content-type: application/json
255258
256259
{
257260
"properties": {
258-
"KeyVaultProperties": { //Key Vault key identifier
259-
KeyVaultUri: "https://{key-vault-name}.vault.azure.net,
260-
KeyName: {key-name},
261-
KeyVersion: {current-version}
261+
"KeyVaultProperties": { //Key Vault key identifier details taken from Key identifier URI
262+
KeyVaultUri: "https://<key-vault-name>.vault.azure.net",
263+
KeyName: "<key-name>",
264+
KeyVersion: "<current-version>"
262265
},
263266
},
264-
"location":"region-name",
267+
"location":"<region-name>",
265268
"identity": {
266269
"type": "systemAssigned"
267270
}
@@ -279,18 +282,18 @@ Content-type: application/json
279282
},
280283
"properties": {
281284
"KeyVaultProperties": { // Key Vault key identifier
282-
KeyVaultUri: "https://{key-vault-name}.vault.azure.net,
283-
KeyName: {key-name},
284-
KeyVersion: {current-version}
285+
KeyVaultUri: "https://key-vault-name.vault.azure.net",
286+
KeyName: "key-name",
287+
KeyVersion: "current-version"
285288
},
286289
"provisioningState": "Succeeded",
287290
"clusterType": "LogAnalytics",
288291
"clusterId": "cluster-id"
289292
},
290-
"id": "/subscriptions/subscription-id/resourceGroups/resource-group-name/providers/Microsoft.OperationalInsights/clusters/cluster-name", //The cluster resource Id
293+
"id": "/subscriptions/subscription-id/resourceGroups/resource-group-name/providers/Microsoft.OperationalInsights/clusters/cluster-name", //The cluster resource Id
291294
"name": "cluster-name",
292295
"type": "Microsoft.OperationalInsights/clusters",
293-
"location": "region-name" //Example: Switzerland North
296+
"location": "region-name" //Example: Switzerland North
294297
}
295298
```
296299

@@ -308,7 +311,7 @@ following details:
308311
**Read the *Cluster* resource ID**
309312

310313
```rst
311-
GET https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters/{cluster-name}?api-version=2019-08-01-preview
314+
GET https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters/<cluster-name>?api-version=2019-08-01-preview
312315
Authorization: Bearer <token>
313316
```
314317

@@ -321,10 +324,10 @@ Authorization: Bearer <token>
321324
"principalId": "principal-Id"
322325
},
323326
"properties": {
324-
"KeyVaultProperties": { // Key Vault key identifier
325-
KeyVaultUri: "https://{key-vault-name}.vault.azure.net,
326-
KeyName: {key-name},
327-
KeyVersion: {current-version}
327+
"KeyVaultProperties": { // Key Vault key identifier
328+
KeyVaultUri: "https://key-vault-name.vault.azure.net",
329+
KeyName: "key-name",
330+
KeyVersion: "current-version"
328331
},
329332
"provisioningState": "Succeeded",
330333
"clusterType": "LogAnalytics",
@@ -349,22 +352,22 @@ Authorization: Bearer <token>
349352
**Associate a workspace to a *Cluster* resource using [Workspaces - Create Or Update](https://docs.microsoft.com/rest/api/loganalytics/workspaces/createorupdate) API**
350353

351354
```rst
352-
PUT https://management.azure.com/https://management.azure.com.resources.windows-int.net/Customer.svc/subscriptions/{subscription-id}/resourcegroups/{resource-group-name}/providers/microsoft.operationalinsights/workspaces/{workspace-name}?api-version=2015-11-01-preview
355+
PUT https://management.azure.com/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>?api-version=2015-11-01-preview
353356
Authorization: Bearer <token>
354357
Content-type: application/json
355358
356359
{
357360
"properties": {
358361
"source": "Azure",
359-
"customerId": {workspace-id}, //Available in Azure portal under Log Analytics workspace Overview section
362+
"customerId": "<workspace-id>", //Available in Azure portal under Log Analytics workspace Overview section
360363
"features": {
361-
"clusterDefinitionId": "cluster-id" //The id of the Cluster resource
364+
"clusterDefinitionId": "<cluster-id>" //It's the "clusterId" value provided in the respond from the previous step
362365
}
363366
},
364-
"id": "/subscriptions/{subscription-id}/resourcegroups/{resource-group-name}/providers/microsoft.operationalinsights/workspaces/{workspace-name}",
365-
"name": "workspace-name",
367+
"id": "/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>",
368+
"name": "<workspace-name>",
366369
"type": "Microsoft.OperationalInsights/workspaces",
367-
"location": "region-name"
370+
"location": "<region-name>"
368371
}
369372
```
370373

@@ -387,7 +390,7 @@ Content-type: application/json
387390
"dataIngestionStatus": "RespectQuota"
388391
}
389392
},
390-
"id": "/subscriptions/{subscription-id}/resourcegroups/{resource-group-name}/providers/microsoft.operationalinsights/workspaces/{workspace-name}",
393+
"id": "/subscriptions/subscription-id/resourcegroups/resource-group-name/providers/microsoft.operationalinsights/workspaces/workspace-name",
391394
"name": "workspace-name",
392395
"type": "Microsoft.OperationalInsights/workspaces",
393396
"location": "region-name"
@@ -495,8 +498,8 @@ with Key Identifier details" step.
495498

496499
- Get all *Cluster* resources for a resource group:
497500

498-
```
499-
GET https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters?api-version=2019-08-01-preview
501+
```rst
502+
GET https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters?api-version=2019-08-01-preview
500503
Authorization: Bearer <token>
501504
```
502505

@@ -512,16 +515,16 @@ with Key Identifier details" step.
512515
"principalId": "principal-Id"
513516
},
514517
"properties": {
515-
"KeyVaultProperties": { // Key Vault key identifier
516-
KeyVaultUri: "https://{key-vault-name}.vault.azure.net,
517-
KeyName: {key-name},
518-
KeyVersion: {current-version}
518+
"KeyVaultProperties": { // Key Vault key identifier
519+
KeyVaultUri: "https://{key-vault-name}.vault.azure.net",
520+
KeyName: "key-name",
521+
KeyVersion: "current-version"
519522
},
520523
"provisioningState": "Succeeded",
521524
"clusterType": "LogAnalytics",
522525
"clusterId": "cluster-id"
523526
},
524-
"id": "/subscriptions/{subscription-id}/resourcegroups/{resource-group-name}/providers/microsoft.operationalinsights/workspaces/{workspace-name}",
527+
"id": "/subscriptions/subscription-id/resourcegroups/resource-group-name/providers/microsoft.operationalinsights/workspaces/workspace-name",
525528
"name": "cluster-name",
526529
"type": "Microsoft.OperationalInsights/clusters",
527530
"location": "region-name"
@@ -533,20 +536,20 @@ with Key Identifier details" step.
533536
- Get all *Cluster* resources for a subscription
534537

535538
```rst
536-
GET https://management.azure.com/subscriptions/{subscription-id}/providers/Microsoft.OperationalInsights/clusters?api-version=2019-08-01-preview
539+
GET https://management.azure.com/subscriptions/<subscription-id>/providers/Microsoft.OperationalInsights/clusters?api-version=2019-08-01-preview
537540
Authorization: Bearer <token>
538541
```
539542

540543
**Response**
541544

542-
The same as response as for '*Cluster* resources for a resource group', but in subscription scope.
545+
The same response as for '*Cluster* resources for a resource group', but in subscription scope.
543546

544547
- Delete a *Cluster* resource -- You need to delete all the associated workspaces before you can delete
545548
your *Cluster* resource:
546549

547550
```rst
548551
DELETE
549-
https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters/{cluster-name}?api-version=2019-08-01-preview
552+
https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters/<cluster-name>?api-version=2019-08-01-preview
550553
Authorization: Bearer <token>
551554
```
552555

@@ -591,12 +594,12 @@ This resource is used as intermediate identity connection between your Key Vault
591594
**Create**
592595

593596
```rst
594-
PUT https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/clusters/{cluster-name}?api-version=2019-08-01-preview
597+
PUT https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.OperationalInsights/clusters/<cluster-name>?api-version=2019-08-01-preview
595598
Authorization: Bearer <token>
596599
Content-type: application/json
597600
598601
{
599-
"location": "region-name",
602+
"location": "<region-name>",
600603
"properties": {
601604
"clusterType":"ApplicationInsights"
602605
},
@@ -616,12 +619,12 @@ Identity is assigned to the *Cluster* resource at creation time.
616619
"identity": {
617620
"type": "SystemAssigned",
618621
"tenantId": "tenant-id",
619-
"principalId": "principle-id" //A GUID that was generated by the managed identity service
622+
"principalId": "principle-id" //A GUID that was generated by the managed identity service
620623
},
621624
"properties": {
622625
"provisioningState": "Succeeded",
623-
"clusterType": "ApplicationInsights", //The value is ‘ApplicationInsights’ for Application Insights CMK
624-
"clusterId": "cluster-id" //A GUID that Log Analytics generates for the cluster
626+
"clusterType": "ApplicationInsights", //The value is ‘ApplicationInsights’ for Application Insights CMK
627+
"clusterId": "cluster-id" //A GUID that Log Analytics generates for the cluster - copy it since you need it for Key Vault and components association
625628
},
626629
"id": "/subscriptions/subscription-id/resourceGroups/resource-group-name/providers/Microsoft.OperationalInsights/clusters/cluster-name", //The cluster resource Id
627630
"name": "cluster-name",
@@ -639,7 +642,7 @@ Content-type: application/json
639642
640643
{
641644
"properties": {
642-
"clusterDefinitionId": "cluster-id" //The id of the cluster resource
645+
"clusterDefinitionId": "cluster-id" //It's the "clusterId" value provided in the respond from the previous step
643646
},
644647
"location": "region-name",
645648
"kind": "component-type",
@@ -657,7 +660,7 @@ Content-type: application/json
657660
"tags": "",
658661
"kind": "",
659662
"properties": {
660-
"clusterDefinitionId": "cluster-id" //The id of the cluster resource
663+
"clusterDefinitionId": "cluster-id" //The Cluster resource ID that is associated to this component
661664
"ApplicationId": "",
662665
"AppId": "",
663666
"Application_Type": "",

0 commit comments

Comments
 (0)