You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/app-service-encrypt-at-rest-using-cmk.md
+40-8Lines changed: 40 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,9 @@ Encrypting your web app's application data at rest requires an Azure Storage Acc
13
13
-[Running from a deployment package](deploy-run-package.md) is a deployment feature of App Service. It allows you to deploy your site content from an Azure Storage Account using a Shared Access Signature (SAS) URL.
14
14
-[Key Vault references](app-service-key-vault-reference.md) are a security feature of App Service. It allows you to import secrets at runtime as application settings. Use this to encrypt the SAS URL of your Azure Storage Account.
15
15
16
-
## Create an Azure Storage account
16
+
## Set up encryption at rest
17
+
18
+
### Create an Azure Storage account
17
19
18
20
First, [create an Azure Storage account](../storage/common/storage-account-create.md) and [encrypt it with customer managed keys](../storage/common/storage-service-encryption.md#customer-managed-keys-with-azure-key-vault). Once the storage account is created, use the [Azure Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md) to upload package files.
19
21
@@ -22,7 +24,7 @@ Next, use the Storage Explorer to [generate an SAS](../vs-azure-tools-storage-ma
22
24
> [!NOTE]
23
25
> Save this SAS URL, this is used later to enable secure access of the deployment package at runtime.
24
26
25
-
## Configure running from a package from your storage account
27
+
###Configure running from a package from your storage account
26
28
27
29
Once you upload your file to Blob storage and have an SAS URL for the file, set the `WEBSITE_RUN_FROM_PACKAGE` application setting to the SAS URL. The following example does it by using Azure CLI:
28
30
@@ -32,7 +34,7 @@ az webapp config appsettings set --name <app-name> --resource-group <resource-gr
32
34
33
35
Adding this application setting causes your web app to restart. After the app has restarted, browse to it and make sure that the app has started correctly using the deployment package. If the application didn't start correctly, see the [Run from package troubleshooting guide](deploy-run-package.md#troubleshooting).
34
36
35
-
## Encrypt the application setting using Key Vault references
37
+
###Encrypt the application setting using Key Vault references
36
38
37
39
Now you can replace the value of the `WEBSITE_RUN_FROM_PACKAGE` application setting with a Key Vault reference to the SAS-encoded URL. This keeps the SAS URL encrypted in Key Vault, which provides an extra layer of security.
38
40
@@ -56,11 +58,45 @@ Now you can replace the value of the `WEBSITE_RUN_FROM_PACKAGE` application sett
56
58
az webapp config appsettings set --settings WEBSITE_RUN_FROM_PACKAGE="@Microsoft.KeyVault(SecretUri=https://Contoso-Vault.vault.azure.net/secrets/external-url/<secret-version>"
57
59
```
58
60
61
+
The `<secret-version>` will be in the output of the previous `az keyvault secret set` command.
62
+
59
63
Updating this application setting causes your web app to restart. After the app has restarted, browse to it make sure it has started correctly using the Key Vault reference.
60
64
65
+
## How to rotate the access token
66
+
67
+
It is best practice to periodically rotate the SAS key of your storage account. To ensure the web app does not inadvertently loose access, you must also update the SAS URL in Key Vault.
68
+
69
+
1. Rotate the SAS key by navigating to your storage account in the Azure Portal. Under **Settings** > **Access keys**, click the icon to rotate the SAS key.
70
+
71
+
1. Copy the new SAS URL, and use the following command to set the updated SAS URL in your key vault:
72
+
73
+
```azurecli
74
+
az keyvault secret set --vault-name "Contoso-Vault" --name "external-url" --value "<SAS-URL>"
75
+
```
76
+
77
+
1. Update the key vault reference in your application setting to the new secret version:
78
+
79
+
```azurecli
80
+
az webapp config appsettings set --settings WEBSITE_RUN_FROM_PACKAGE="@Microsoft.KeyVault(SecretUri=https://Contoso-Vault.vault.azure.net/secrets/external-url/<secret-version>"
81
+
```
82
+
83
+
The `<secret-version>` will be in the output of the previous `az keyvault secret set` command.
84
+
85
+
## How to revoke the web app's data access
86
+
87
+
There are two methods to revoke the web app's access to the storage account.
88
+
89
+
### Rotate the SAS key for the Azure Storage account
90
+
91
+
If the SAS key for the storage account is rotated, the web app will no longer have access to the storage account, but it will continue to run with the last downloaded version of the package file. Restart the web app to clear the last downloaded version.
92
+
93
+
### Remove the web app's access to Key Vault
94
+
95
+
You can revoke the web app's access to the site data by disabling the web app's access to Key Vault. To do this, remove the access policy for the web app's identity. This is the same identity you created earlier while configuring key vault references.
96
+
61
97
## Summary
62
98
63
-
Your application files are now encrypted at rest in your storage account. When your web app starts, it retrieves the SAS URL from your key vault. Finally, the web app loads the application files from storage.
99
+
Your application files are now encrypted at rest in your storage account. When your web app starts, it retrieves the SAS URL from your key vault. Finally, the web app loads the application files from the storage account.
64
100
65
101
If you need to revoke the web app's access to your storage account, you can either revoke access to the key vault or rotate the storage account keys, which invalidates the SAS URL.
66
102
@@ -70,10 +106,6 @@ If you need to revoke the web app's access to your storage account, you can eith
70
106
71
107
Only the cost associated with the Azure Storage Account and any applicable egress charges.
72
108
73
-
### What happens if the SAS token expires or rotates?
74
-
75
-
If the SAS URL is invalidated for any reason, the web app will continue to run with the last downloaded version of the package file. You must update the value of `WEBSITE_RUN_FROM_PACKAGE` with the new SAS URL for the web app to reestablish a connection to the storage account.
76
-
77
109
### How does running from the deployment package affect my web app?
78
110
79
111
- Running your app from the deployment package makes `wwwroot/` read-only. Your app receives an error when it attempts to write to this directory.
Copy file name to clipboardExpand all lines: articles/azure-functions/functions-encrypt-at-rest-using-cmk.md
+40-8Lines changed: 40 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,9 @@ Encrypting your web app's application data at rest requires an Azure Storage Acc
13
13
-[Running from a deployment package](deploy-run-package.md) is a deployment feature of App Service. It allows you to deploy your site content from an Azure Storage Account using a Shared Access Signature (SAS) URL.
14
14
-[Key Vault references](app-service-key-vault-reference.md) are a security feature of App Service. It allows you to import secrets at runtime as application settings. Use this to encrypt the SAS URL of your Azure Storage Account.
15
15
16
-
## Create an Azure Storage account
16
+
## Set up encryption at rest
17
+
18
+
### Create an Azure Storage account
17
19
18
20
First, [create an Azure Storage account](../storage/common/storage-account-create.md) and [encrypt it with customer managed keys](../storage/common/storage-service-encryption.md#customer-managed-keys-with-azure-key-vault). Once the storage account is created, use the [Azure Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md) to upload package files.
19
21
@@ -22,7 +24,7 @@ Next, use the Storage Explorer to [generate an SAS](../vs-azure-tools-storage-ma
22
24
> [!NOTE]
23
25
> Save this SAS URL, this is used later to enable secure access of the deployment package at runtime.
24
26
25
-
## Configure running from a package from your storage account
27
+
###Configure running from a package from your storage account
26
28
27
29
Once you upload your file to Blob storage and have an SAS URL for the file, set the `WEBSITE_RUN_FROM_PACKAGE` application setting to the SAS URL. The following example does it by using Azure CLI:
28
30
@@ -32,7 +34,7 @@ az webapp config appsettings set --name <app-name> --resource-group <resource-gr
32
34
33
35
Adding this application setting causes your web app to restart. After the app has restarted, browse to it and make sure that the app has started correctly using the deployment package. If the application didn't start correctly, see the [Run from package troubleshooting guide](deploy-run-package.md#troubleshooting).
34
36
35
-
## Encrypt the application setting using Key Vault references
37
+
###Encrypt the application setting using Key Vault references
36
38
37
39
Now you can replace the value of the `WEBSITE_RUN_FROM_PACKAGE` application setting with a Key Vault reference to the SAS-encoded URL. This keeps the SAS URL encrypted in Key Vault, which provides an extra layer of security.
38
40
@@ -56,11 +58,45 @@ Now you can replace the value of the `WEBSITE_RUN_FROM_PACKAGE` application sett
56
58
az webapp config appsettings set --settings WEBSITE_RUN_FROM_PACKAGE="@Microsoft.KeyVault(SecretUri=https://Contoso-Vault.vault.azure.net/secrets/external-url/<secret-version>"
57
59
```
58
60
61
+
The `<secret-version>` will be in the output of the previous `az keyvault secret set` command.
62
+
59
63
Updating this application setting causes your web app to restart. After the app has restarted, browse to it make sure it has started correctly using the Key Vault reference.
60
64
65
+
## How to rotate the access token
66
+
67
+
It is best practice to periodically rotate the SAS key of your storage account. To ensure the web app does not inadvertently loose access, you must also update the SAS URL in Key Vault.
68
+
69
+
1. Rotate the SAS key by navigating to your storage account in the Azure Portal. Under **Settings** > **Access keys**, click the icon to rotate the SAS key.
70
+
71
+
1. Copy the new SAS URL, and use the following command to set the updated SAS URL in your key vault:
72
+
73
+
```azurecli
74
+
az keyvault secret set --vault-name "Contoso-Vault" --name "external-url" --value "<SAS-URL>"
75
+
```
76
+
77
+
1. Update the key vault reference in your application setting to the new secret version:
78
+
79
+
```azurecli
80
+
az webapp config appsettings set --settings WEBSITE_RUN_FROM_PACKAGE="@Microsoft.KeyVault(SecretUri=https://Contoso-Vault.vault.azure.net/secrets/external-url/<secret-version>"
81
+
```
82
+
83
+
The `<secret-version>` will be in the output of the previous `az keyvault secret set` command.
84
+
85
+
## How to revoke the web app's data access
86
+
87
+
There are two methods to revoke the web app's access to the storage account.
88
+
89
+
### Rotate the SAS key for the Azure Storage account
90
+
91
+
If the SAS key for the storage account is rotated, the web app will no longer have access to the storage account, but it will continue to run with the last downloaded version of the package file. Restart the web app to clear the last downloaded version.
92
+
93
+
### Remove the web app's access to Key Vault
94
+
95
+
You can revoke the web app's access to the site data by disabling the web app's access to Key Vault. To do this, remove the access policy for the web app's identity. This is the same identity you created earlier while configuring key vault references.
96
+
61
97
## Summary
62
98
63
-
Your application files are now encrypted at rest in your storage account. When your web app starts, it retrieves the SAS URL from your key vault. Finally, the web app loads the application files from storage.
99
+
Your application files are now encrypted at rest in your storage account. When your web app starts, it retrieves the SAS URL from your key vault. Finally, the web app loads the application files from the storage account.
64
100
65
101
If you need to revoke the web app's access to your storage account, you can either revoke access to the key vault or rotate the storage account keys, which invalidates the SAS URL.
66
102
@@ -70,10 +106,6 @@ If you need to revoke the web app's access to your storage account, you can eith
70
106
71
107
Only the cost associated with the Azure Storage Account and any applicable egress charges.
72
108
73
-
### What happens if the SAS token expires or rotates?
74
-
75
-
If the SAS URL is invalidated for any reason, the web app will continue to run with the last downloaded version of the package file. You must update the value of `WEBSITE_RUN_FROM_PACKAGE` with the new SAS URL for the web app to reestablish a connection to the storage account.
76
-
77
109
### How does running from the deployment package affect my web app?
78
110
79
111
- Running your app from the deployment package makes `wwwroot/` read-only. Your app receives an error when it attempts to write to this directory.
0 commit comments