You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Enable encryption with customer-managed keys in the Azure portal
22
+
23
+
This article shows you how to enable customer-managed keys encryption using the Azure portal. By default, Azure Data Explorer encryption uses Microsoft-managed keys. Configure your Azure Data Explorer cluster to use customer-managed keys and specify the key to associate with the cluster.
24
+
25
+
1. In the [Azure portal](https://portal.azure.com/), go to your [Azure Data Explorer cluster](create-cluster-database-portal.md#create-a-cluster) resource.
26
+
1. Select **Settings** > **Encryption** in left pane of portal.
27
+
1. In the **Encryption** pane, select **On** for the **Customer-managed key** setting.
1. In the **Select key from Azure Key Vault** window, select an existing **Key vault** from the dropdown list. If you select **Create new** to [create a new Key Vault](/azure/key-vault/quick-create-portal#create-a-vault), you'll be routed to the **Create Key Vault** screen.
33
+
34
+
1. Select **Key**.
35
+
1. Select **Version**.
36
+
1. Click **Select**.
37
+
38
+
39
+
40
+
1. In the **Encryption** pane that now contains your key, select **Save**. When CMK creation succeeds, you'll see a success message in **Notifications**.
By enabling customer-managed keys for your Azure Data Explorer cluster, you'll be creating a system assigned identity for the cluster if one doesn't exist. In addition, you'll be providing the required view permissions to your Azure Data Explorer cluster on the selected Key Vault and get the Key Vault properties.
45
+
46
+
> [!NOTE]
47
+
> Select **Off** to remove the customer-managed key after it has been created.
48
+
49
+
## Next steps
50
+
51
+
*[Secure Azure Data Explorer clusters in Azure](security.md)
52
+
*[Secure your cluster in Azure Data Explorer - Azure portal](manage-cluster-security.md) by enabling encryption at rest.
53
+
*[Configure customer-managed-keys using the Azure Resource Manager template](customer-managed-keys-resource-manager.md)
54
+
*[Configure customer-managed-keys using C#](customer-managed-keys-csharp.md)
[!INCLUDE [data-explorer-configure-customer-managed-keys part 2](../../includes/data-explorer-configure-customer-managed-keys-b.md)]
22
+
20
23
## Configure encryption with customer-managed keys
21
24
22
25
In this section, you configure customer-managed keys using Azure Resource Manager templates. By default, Azure Data Explorer encryption uses Microsoft-managed keys. In this step, configure your Azure Data Explorer cluster to use customer-managed keys and specify the key to associate with the cluster.
To create a new key vault using PowerShell, call [New-AzKeyVault](/powershell/module/az.keyvault/new-azkeyvault). The key vault that you use to store customer-managed keys for Azure Data Explorer encryption must have two key protection settings enabled, **Soft Delete** and **Do Not Purge**. Replace the placeholder values in brackets with your own values in example below.
12
+
13
+
```azurepowershell-interactive
14
+
$keyVault = New-AzKeyVault -Name <key-vault> `
15
+
-ResourceGroupName <resource_group> `
16
+
-Location <location> `
17
+
-EnableSoftDelete `
18
+
-EnablePurgeProtection
19
+
```
20
+
21
+
## Configure the key vault access policy
22
+
23
+
Next, configure the access policy for the key vault so that the cluster has permissions to access it. In this step, you'll use the system-assigned managed identity that you previously assigned to the cluster. To set the access policy for the key vault, call [Set-AzKeyVaultAccessPolicy](/powershell/module/az.keyvault/set-azkeyvaultaccesspolicy). Replace the placeholder values in brackets with your own values and use the variables defined in the previous examples.
24
+
25
+
```azurepowershell-interactive
26
+
Set-AzKeyVaultAccessPolicy `
27
+
-VaultName $keyVault.VaultName `
28
+
-ObjectId $cluster.Identity.PrincipalId `
29
+
-PermissionsToKeys wrapkey,unwrapkey,get,recover
30
+
```
31
+
32
+
## Create a new key
33
+
34
+
Next, create a new key in the key vault. To create a new key, call [Add-AzKeyVaultKey](/powershell/module/az.keyvault/add-azkeyvaultkey). Replace the placeholder values in brackets with your own values and use the variables defined in the previous examples.
Copy file name to clipboardExpand all lines: includes/data-explorer-configure-customer-managed-keys.md
+9-34Lines changed: 9 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,44 +6,19 @@ ms.date: 01/07/2020
6
6
ms.author: orspodek
7
7
---
8
8
9
-
Azure Data Explorer encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can supply customer-managed keys to use for data encryption. Customer-managed keys must be stored in an [Azure Key Vault](/azure/key-vault/key-vault-overview). You can create your own keys and store them in a key vault, or you can use an Azure Key Vault API to generate keys. The Azure Data Explorer cluster and the key vault must be in the same region, but they can be in different subscriptions. For a detailed explanation on customer-managed keys, see [customer-managed keys with Azure Key Vault](/azure/storage/common/storage-service-encryption). This article shows you how to configure customer-managed keys.
9
+
Azure Data Explorer encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can supply customer-managed keys to use for data encryption.
10
10
11
-
To configure customer-managed keys with Azure Data Explorer, you must [set two properties on the key vault](/azure/key-vault/key-vault-ovw-soft-delete): **Soft Delete**and **Do Not Purge**. These properties aren't enabled by default. To enable these properties, use [PowerShell](/azure/key-vault/key-vault-soft-delete-powershell) or [Azure CLI](/azure/key-vault/key-vault-soft-delete-cli). Only RSA keys and key size 2048 are supported.
11
+
Customer-managed keys must be stored in an [Azure Key Vault](/azure/key-vault/key-vault-overview). You can create your own keys and store them in a key vault, or you can use an Azure Key Vault API to generate keys. The Azure Data Explorer cluster and the keyvault must be in the same region, but they can be in different subscriptions. For a detailed explanation on customer-managed keys, see [customer-managed keys with Azure Key Vault](/azure/storage/common/storage-service-encryption).
12
12
13
-
> [!NOTE]
14
-
> Data encryption using customer managed keys is not supported on [leader and follower clusters](/azure/data-explorer/follower).
15
-
16
-
## Assign an identity to the cluster
17
-
18
-
To enable customer-managed keys for your cluster, first assign a system-assigned managed identity to the cluster. You'll use this managed identity to grant the cluster permissions to access the key vault. To configure system-assigned managed identities, see [managed identities](/azure/data-explorer/managed-identities).
19
-
20
-
## Create a new key vault
13
+
This article shows you how to configure customer-managed keys.
21
14
22
-
To create a new key vault using PowerShell, call [New-AzKeyVault](/powershell/module/az.keyvault/new-azkeyvault). The key vault that you use to store customer-managed keys for Azure Data Explorer encryption must have two key protection settings enabled, **Soft Delete** and **Do Not Purge**. Replace the placeholder values in brackets with your own values in example below.
15
+
## Configure Azure Key Vault
23
16
24
-
```azurepowershell-interactive
25
-
$keyVault = New-AzKeyVault -Name <key-vault> `
26
-
-ResourceGroupName <resource_group> `
27
-
-Location <location> `
28
-
-EnableSoftDelete `
29
-
-EnablePurgeProtection
30
-
```
17
+
To configure customer-managed keys with Azure Data Explorer, you must [set two properties on the key vault](/azure/key-vault/key-vault-ovw-soft-delete): **Soft Delete** and **Do Not Purge**. These properties aren't enabled by default. To enable these properties, perform **Enabling soft-delete** and **Enabling Purge Protection** in [PowerShell](/azure/key-vault/key-vault-soft-delete-powershell) or [Azure CLI](/azure/key-vault/key-vault-soft-delete-cli) on a new or existing key vault. Only RSA keys of size 2048 are supported. For more information about keys, see [Key Vault keys](/azure/key-vault/about-keys-secrets-and-certificates#key-vault-keys).
31
18
32
-
## Configure the key vault access policy
33
-
34
-
Next, configure the access policy for the key vault so that the cluster has permissions to access it. In this step, you'll use the system-assigned managed identity that you previously assigned to the cluster. To set the access policy for the key vault, call [Set-AzKeyVaultAccessPolicy](/powershell/module/az.keyvault/set-azkeyvaultaccesspolicy). Replace the placeholder values in brackets with your own values and use the variables defined in the previous examples.
35
-
36
-
```azurepowershell-interactive
37
-
Set-AzKeyVaultAccessPolicy `
38
-
-VaultName $keyVault.VaultName `
39
-
-ObjectId $cluster.Identity.PrincipalId `
40
-
-PermissionsToKeys wrapkey,unwrapkey,get,recover
41
-
```
42
-
43
-
## Create a new key
19
+
> [!NOTE]
20
+
> Data encryption using customer managed keys is not supported on [leader and follower clusters](/azure/data-explorer/follower).
44
21
45
-
Next, create a new key in the key vault. To create a new key, call [Add-AzKeyVaultKey](/powershell/module/az.keyvault/add-azkeyvaultkey). Replace the placeholder values in brackets with your own values and use the variables defined in the previous examples.
To enable customer-managed keys for your cluster, first assign a system-assigned managed identity to the cluster. You'll use this managed identity to grant the cluster permissions to access the key vault. To configure system-assigned managed identities, see [managed identities](/azure/data-explorer/managed-identities).
0 commit comments