Skip to content

Commit cb84d21

Browse files
YunhoYunho
authored andcommitted
fixes based on comments
1 parent 230aad7 commit cb84d21

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

articles/azure-fluid-relay/concepts/customer-managed-keys.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,16 @@ Before configuring CMK on your Azure Fluid Relay resource, the following prerequ
3131
- Keys must be RSA key and not EC key since EC key doesn’t support WRAP and UNWRAP.
3232
- A user assigned managed identity must be created with necessary permission (GET, WRAP and UNWRAP) to the key vault in step 1. More information [here](../../active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad.md). Grant GET, WRAP and UNWRAP under Key Permissions in AKV.
3333
- Azure Key Vault, user assigned identity, and the Fluid Relay resource must be in the same region and in the same Microsoft Entra tenant.
34+
- The Key Vault and the key must remain active for the entire lifetime of your Fluid Relay resources.
35+
- **Do NOT** delete or disable the key vault or the key until all associated Fluid Relay services have been deleted.
36+
Otherwise, your Fluid Relay resource will enter an **unusable state**. In this case, please [recover your key or key vault](/azure/key-vault/general/key-vault-recovery?tabs=azure-portal).
37+
Azure Fluid Relay cannot recover your key or key vault, as they are fully managed by you (the client).
3438
- If you provide the key URL with a specific key version, **only that version** is used for CMK purposes.
3539
If you later add a new key version, you must **manually** update the key URL in the CMK settings of the Fluid Relay resource to make the new version effective.
3640
The Fluid Relay service fails if the specified key version is deleted or disabled without updating the resource to use a valid version.
3741
- To allow the Fluid Relay service to automatically use the latest key version of the key from your key vault, you can omit the key version in the encryption key URL. This setting makes Fluid Relay Service's storage dependency to check the key vault daily for a new version of the customer-managed key and automatically updates the key to the latest version.
3842
However, you are still responsible for managing and rotating key versions in your Key Vault.
39-
> Due to resource limitations, switching to this auto-update setting may fail. If that happens, please specify a key version explicitly and perform a manual update on your Fluid Relay resource for new [key](/azure/key-vault/keys/about-keys) versions.
43+
- Due to resource limitations, switching to this auto-update setting may fail. If that happens, please specify a key version explicitly and perform a manual update on your Fluid Relay resource for new [key](/azure/key-vault/keys/about-keys) versions.
4044

4145

4246
## Create a Fluid Relay resource with CMK
@@ -90,7 +94,7 @@ You need to install [Azure Fluid Relay module](/powershell/module/az.fluidrelay)
9094
Install-Module Az.FluidRelay
9195
```
9296

93-
And make sure you complete all the prerequsite steps.
97+
And make sure you complete all the prerequisite steps.
9498

9599
Example of creating a Fluid Relay Service with CMK enabled:
96100
```azurepowershell
@@ -111,7 +115,7 @@ For more information about the command, see [New-AzFluidRelayServer](/powershell
111115
### [Azure CLI](#tab/azure-cli)
112116
To create Fluid Relay with CMK enabled using Azure CLI, you need to install [fluid-relay](/cli/azure/fluid-relay) extension first. See [instructions](/cli/azure/azure-cli-extensions-overview).
113117

114-
And make sure you complete all the [prerequsite](#prerequisites) steps.
118+
And make sure you complete all the [prerequisite](#prerequisites) steps.
115119

116120
Example of creating a Fluid Relay Service with CMK enabled:
117121
```azurecli

0 commit comments

Comments
 (0)