Skip to content

Commit c3963bd

Browse files
EldertGrootenboerMSEldertGrootenboerMS
committed
Styling changes for EH
1 parent 0a68fd6 commit c3963bd

File tree

2 files changed

+136
-142
lines changed

2 files changed

+136
-142
lines changed

‎articles/event-hubs/configure-customer-managed-key.md

Lines changed: 131 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -36,35 +36,34 @@ After you enable customer-managed keys, you need to associate the customer manag
3636
> [!IMPORTANT]
3737
> Using customer-managed keys with Azure Event Hubs requires that the key vault have two required properties configured. They are: **Soft Delete** and **Do Not Purge**. These properties are enabled by default when you create a new key vault in the Azure portal. However, if you need to enable these properties on an existing key vault, you must use either PowerShell or Azure CLI.
3838
39-
# [Key Vault](#tab/Key-Vault)
39+
# [Key Vault](#tab/Key-Vault)
4040

41-
1. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
41+
2. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
4242

43-
```azurecli-interactive
44-
az keyvault create --name ContosoVault --resource-group ContosoRG --location westus --enable-soft-delete true --enable-purge-protection true
45-
```
46-
1. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
43+
```azurecli-interactive
44+
az keyvault create --name ContosoVault --resource-group ContosoRG --location westus --enable-soft-delete true --enable-purge-protection true
45+
```
46+
3. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
4747
48-
```azurecli-interactive
49-
az keyvault update --name ContosoVault --resource-group ContosoRG --enable-purge-protection true
50-
```
48+
```azurecli-interactive
49+
az keyvault update --name ContosoVault --resource-group ContosoRG --enable-purge-protection true
50+
```
5151
52-
# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
52+
# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
5353
54-
1. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
54+
2. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
5555
56-
```azurecli-interactive
57-
az keyvault create --hsm-name ContosoVault --resource-group ContosoRG --location westus --enable-soft-delete true --enable-purge-protection true
58-
```
59-
1. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
56+
```azurecli-interactive
57+
az keyvault create --hsm-name ContosoVault --resource-group ContosoRG --location westus --enable-soft-delete true --enable-purge-protection true
58+
```
59+
3. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
6060
61-
```azurecli-interactive
62-
az keyvault update --hsm-name ContosoVault --resource-group ContosoRG --enable-purge-protection true
63-
```
61+
```azurecli-interactive
62+
az keyvault update --hsm-name ContosoVault --resource-group ContosoRG --enable-purge-protection true
63+
```
64+
---
6465
65-
---
66-
67-
1. Create keys by following these steps:
66+
4. Create keys by following these steps:
6867
1. To create a new key, select **Generate/Import** from the **Keys** menu under **Settings**.
6968
7069
![Select Generate/Import button](./media/configure-customer-managed-key/select-generate-import.png)
@@ -87,15 +86,13 @@ There are two types of managed identities that you can assign to an Event Hubs n
8786
8887
For more information, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md).
8988
90-
9189
## Encrypt using system-assigned identities (template)
9290
This section shows how to do the following tasks using **Azure Resource Manager templates**.
9391
9492
1. Create an **Event Hubs namespace** with a managed service identity.
9593
2. Create a **key vault** and grant the service identity access to the key vault.
9694
3. Update the Event Hubs namespace with the key vault information (key/value).
9795
98-
9996
### Create an Event Hubs cluster and namespace with managed service identity
10097
This section shows you how to create an Azure Event Hubs namespace with managed service identity by using an Azure Resource Manager template and PowerShell.
10198
@@ -204,13 +201,13 @@ This section shows you how to create an Azure Event Hubs namespace with managed
204201
205202
### Grant Event Hubs namespace identity access to key vault
206203
207-
1. Set the key vault access policy so that the managed identity of the Event Hubs namespace can access key value in the key vault. Use the ID of the Event Hubs namespace from the previous section.
204+
Set the key vault access policy so that the managed identity of the Event Hubs namespace can access key value in the key vault. Use the ID of the Event Hubs namespace from the previous section.
208205
209-
```powershell
210-
$identity = (Get-AzureRmResource -ResourceId $EventHubNamespaceId -ExpandProperties).Identity
211-
212-
Set-AzureRmKeyVaultAccessPolicy -VaultName {keyVaultName} -ResourceGroupName {RGName} -ObjectId $identity.PrincipalId -PermissionsToKeys get,wrapKey,unwrapKey,list
213-
```
206+
```powershell
207+
$identity = (Get-AzureRmResource -ResourceId $EventHubNamespaceId -ExpandProperties).Identity
208+
209+
Set-AzureRmKeyVaultAccessPolicy -VaultName {keyVaultName} -ResourceGroupName {RGName} -ObjectId $identity.PrincipalId -PermissionsToKeys get,wrapKey,unwrapKey,list
210+
```
214211

215212
### Encrypt data in Event Hubs namespace with customer-managed key from key vault
216213
You have done the following steps so far:
@@ -302,56 +299,55 @@ In this step, you will update the Event Hubs namespace with key vault informatio
302299
> - `<KeyVaultName>` - Name of your key vault
303300
> - `<KeyName>` - Name of the key in the key vault
304301

305-
# [Key Vault](#tab/Key-Vault)
306-
307-
```json
308-
{
309-
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
310-
"contentVersion":"1.0.0.0",
311-
"parameters":{
312-
"clusterName":{
313-
"value":"<EventHubsClusterName>"
314-
},
315-
"namespaceName":{
316-
"value":"<EventHubsNamespaceName>"
317-
},
318-
"location":{
319-
"value":"<Location>"
320-
},
321-
"keyName":{
322-
"value":"<KeyName>"
323-
},
324-
"keyVaultUri":{
325-
"value":"https://<KeyVaultName>.vault.azure.net"
326-
}
327-
}
328-
}
329-
```
330-
331-
# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
332-
333-
```json
334-
{
335-
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
336-
"contentVersion":"1.0.0.0",
337-
"parameters":{
338-
"namespaceName":{
339-
"value":"<ServiceBusNamespaceName>"
340-
},
341-
"location":{
342-
"value":"<Location>"
343-
},
344-
"keyName":{
345-
"value":"<KeyName>"
346-
},
347-
"keyVaultUri":{
348-
"value":"https://<KeyVaultName>.managedhsm.azure.net"
349-
}
350-
}
351-
}
352-
```
353-
354-
---
302+
# [Key Vault](#tab/Key-Vault)
303+
304+
```json
305+
{
306+
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
307+
"contentVersion":"1.0.0.0",
308+
"parameters":{
309+
"clusterName":{
310+
"value":"<EventHubsClusterName>"
311+
},
312+
"namespaceName":{
313+
"value":"<EventHubsNamespaceName>"
314+
},
315+
"location":{
316+
"value":"<Location>"
317+
},
318+
"keyName":{
319+
"value":"<KeyName>"
320+
},
321+
"keyVaultUri":{
322+
"value":"https://<KeyVaultName>.vault.azure.net"
323+
}
324+
}
325+
}
326+
```
327+
328+
# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
329+
330+
```json
331+
{
332+
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
333+
"contentVersion":"1.0.0.0",
334+
"parameters":{
335+
"namespaceName":{
336+
"value":"<ServiceBusNamespaceName>"
337+
},
338+
"location":{
339+
"value":"<Location>"
340+
},
341+
"keyName":{
342+
"value":"<KeyName>"
343+
},
344+
"keyVaultUri":{
345+
"value":"https://<KeyVaultName>.managedhsm.azure.net"
346+
}
347+
}
348+
}
349+
```
350+
---
355351

356352
3. Run the following PowerShell command to deploy the Resource Manager template. Replace `{MyRG}` with the name of your resource group before running the command.
357353

@@ -509,65 +505,64 @@ This section gives you an example that shows you how to do the following tasks u
509505
]
510506
}
511507
```
512-
1. Create a template parameter file: **CreateEventHubsNamespaceWithUserIdentityAndEncryptionParams.json**.
513-
514-
# [Key Vault](#tab/Key-Vault)
515-
516-
```json
517-
{
518-
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
519-
"contentVersion":"1.0.0.0",
520-
"parameters":{
521-
"namespaceName":{
522-
"value":"<EventHubsNamespaceName>"
523-
},
524-
"location":{
525-
"value":"<Location>"
526-
},
527-
"keyVaultUri":{
528-
"value":"https://<KeyVaultName>.vault.azure.net"
529-
},
530-
"keyName":{
531-
"value":"<KeyName>"
532-
},
533-
"identity": {
534-
"value": {
535-
"userAssignedIdentity": "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<USER MANAGED IDENTITY NAME>"
536-
}
508+
2. Create a template parameter file: **CreateEventHubsNamespaceWithUserIdentityAndEncryptionParams.json**.
509+
510+
# [Key Vault](#tab/Key-Vault)
511+
512+
```json
513+
{
514+
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
515+
"contentVersion":"1.0.0.0",
516+
"parameters":{
517+
"namespaceName":{
518+
"value":"<EventHubsNamespaceName>"
519+
},
520+
"location":{
521+
"value":"<Location>"
522+
},
523+
"keyVaultUri":{
524+
"value":"https://<KeyVaultName>.vault.azure.net"
525+
},
526+
"keyName":{
527+
"value":"<KeyName>"
528+
},
529+
"identity": {
530+
"value": {
531+
"userAssignedIdentity": "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<USER MANAGED IDENTITY NAME>"
537532
}
538-
}
539-
}
540-
```
541-
542-
# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
543-
544-
```json
545-
{
546-
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
547-
"contentVersion":"1.0.0.0",
548-
"parameters":{
549-
"namespaceName":{
550-
"value":"<ServiceBusNamespaceName>"
551-
},
552-
"location":{
553-
"value":"<Location>"
554-
},
555-
"keyVaultUri":{
556-
"value":"https://<KeyVaultName>.managedhsm.azure.net"
557-
},
558-
"keyName":{
559-
"value":"<KeyName>"
560-
},
561-
"identity": {
562-
"value": {
563-
"userAssignedIdentity": "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<USER MANAGED IDENTITY NAME>"
564-
}
533+
}
534+
}
535+
}
536+
```
537+
538+
# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
539+
540+
```json
541+
{
542+
"$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
543+
"contentVersion":"1.0.0.0",
544+
"parameters":{
545+
"namespaceName":{
546+
"value":"<ServiceBusNamespaceName>"
547+
},
548+
"location":{
549+
"value":"<Location>"
550+
},
551+
"keyVaultUri":{
552+
"value":"https://<KeyVaultName>.managedhsm.azure.net"
553+
},
554+
"keyName":{
555+
"value":"<KeyName>"
556+
},
557+
"identity": {
558+
"value": {
559+
"userAssignedIdentity": "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<USER MANAGED IDENTITY NAME>"
565560
}
566-
}
567-
}
568-
```
569-
570-
---
561+
}
562+
}
563+
}
564+
```
565+
---
571566

572567
In the parameter file, replace placeholders with appropriate values.
573568

@@ -587,7 +582,6 @@ This section gives you an example that shows you how to do the following tasks u
587582
New-AzResourceGroupDeployment -Name CreateEventHubsNamespaceWithEncryption -ResourceGroupName {MyRG} -TemplateFile ./ CreateEventHubsNamespaceWithUserIdentityAndEncryption.json -TemplateParameterFile ./ CreateEventHubsNamespaceWithUserIdentityAndEncryptionParams.json
588583
```
589584
590-
591585
## Use both user-assigned and system-assigned identities
592586
A namespace can have both system-assigned and user-assigned identities at the same time. In this case, the `type` property would be `SystemAssigned`, `UserAssigned` as shown in the following example.
593587

‎articles/service-bus-messaging/configure-customer-managed-key.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -198,11 +198,11 @@ This section shows you how to create an Azure Service Bus namespace with managed
198198
199199
Set the key vault access policy so that the managed identity of the Service Bus namespace can access key value in the key vault. Use the ID of the Service Bus namespace from the previous section.
200200
201-
```powershell
202-
$identity = (Get-AzureRmResource -ResourceId $ServiceBusNamespaceId -ExpandProperties).Identity
203-
204-
Set-AzureRmKeyVaultAccessPolicy -VaultName {keyVaultName} -ResourceGroupName {RGName} -ObjectId $identity.PrincipalId -PermissionsToKeys get,wrapKey,unwrapKey,list
205-
```
201+
```powershell
202+
$identity = (Get-AzureRmResource -ResourceId $ServiceBusNamespaceId -ExpandProperties).Identity
203+
204+
Set-AzureRmKeyVaultAccessPolicy -VaultName {keyVaultName} -ResourceGroupName {RGName} -ObjectId $identity.PrincipalId -PermissionsToKeys get,wrapKey,unwrapKey,list
205+
```
206206

207207
### Encrypt data in Service Bus namespace with customer-managed key from key vault
208208
You have done the following steps so far:

0 commit comments

Comments
 (0)