You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-cache-for-redis/cache-managed-identity.md
+11-16Lines changed: 11 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,13 +25,9 @@ Presently, Azure Cache for Redis can use a managed identity to connect with a st
25
25
26
26
Managed identity lets you simplify the process of securely connecting to your chosen storage account for these tasks.
27
27
28
-
> [!NOTE]
29
-
> This functionality does not yet support authentication for connecting to a cache instance.
30
-
>
31
-
32
28
Azure Cache for Redis supports [both types of managed identity](../active-directory/managed-identities-azure-resources/overview.md):
33
29
34
-
-**System-assigned identity** is specific to the resource. In this case, the cache is the resource. When the cache is deleted, the identity is deleted.
30
+
-**System-assigned identity**is specific to the resource. In this case, the cache is the resource. When the cache is deleted, the identity is deleted.
35
31
36
32
-**User-assigned identity** is specific to a user, not the resource. It can be assigned to any resource that supports managed identity and remains even when you delete the cache.
1. Create a new storage account or open an existing storage account that you would like to connect to your cache instance.
132
128
133
-
2. Open the **Access control (IAM)** from the Resource menu. Then, select **Add**, and **Add role assignment**.
129
+
1. Open the **Access control (IAM)** from the Resource menu. Then, select **Add**, and **Add role assignment**.
134
130
135
131
:::image type="content" source="media/cache-managed-identity/demo-storage.png" alt-text="Screenshot showing the Access Control (IAM) settings.":::
136
132
137
-
3. Search for the **Storage Blob Data Contributor** on the Role pane. Select it and **Next**.
133
+
1. Search for the **Storage Blob Data Contributor** on the Role pane. Select it and **Next**.
138
134
139
135
:::image type="content" source="media/cache-managed-identity/role-assignment.png" alt-text="Screenshot showing Add role assignment form with list of roles.":::
140
136
141
-
4. Select the **Members** tab. Under **Assign access to** select **Managed Identity**, and select on **Select members**. A sidebar pops up next to the working pane.
137
+
1. Select the **Members** tab. Under **Assign access to** select **Managed Identity**, and select on **Select members**. A sidebar pops up next to the working pane.
142
138
143
139
:::image type="content" source="media/cache-managed-identity/select-members.png" alt-text="Screenshot showing add role assignment form with members pane.":::
144
140
145
-
5. Use the drop-down under **Managed Identity** to choose either a **User-assigned managed identity** or a **System-assigned managed identity**. If you have many managed identities, you can search by name. Choose the managed identities you want and then **Select**. Then, **Review + assign** to confirm.
141
+
1. Use the drop-down under **Managed Identity** to choose either a **User-assigned managed identity** or a **System-assigned managed identity**. If you have many managed identities, you can search by name. Choose the managed identities you want and then **Select**. Then, **Review + assign** to confirm.
146
142
147
143
:::image type="content" source="media/cache-managed-identity/review-assign.png" alt-text="Screenshot showing Managed Identity form with User-assigned managed identity indicated.":::
148
144
149
-
6. You can confirm if the identity has been assigned successfully by checking your storage account's role assignments under **Storage Blob Data Contributor**.
145
+
1. You can confirm if the identity has been assigned successfully by checking your storage account's role assignments under **Storage Blob Data Contributor**.
150
146
151
147
:::image type="content" source="media/cache-managed-identity/blob-data.png" alt-text="Screenshot of Storage Blob Data Contributor list.":::
>- add an Azure Cache for Redis instance as a storage blob data contributor through system-assigned identity, and
156
152
>- check [**Allow Azure services on the trusted services list to access this storage account**](../storage/common/storage-network-security.md?tabs=azure-portal#grant-access-to-trusted-azure-services).
157
153
158
-
159
154
If you're not using managed identity and instead authorizing a storage account with a key, then having firewall exceptions on the storage account breaks the persistence process and the import-export processes.
160
155
161
156
## Use managed identity to access a storage account
@@ -164,27 +159,27 @@ If you're not using managed identity and instead authorizing a storage account w
164
159
165
160
1. Open the Azure Cache for Redis instance that has been assigned the Storage Blob Data Contributor role and go to the **Data persistence** on the Resource menu.
166
161
167
-
2. Change the **Authentication Method** to **Managed Identity** and select the storage account you configured earlier in the article. select **Save**.
162
+
1. Change the **Authentication Method** to **Managed Identity** and select the storage account you configured earlier in the article. select **Save**.
168
163
169
164
:::image type="content" source="media/cache-managed-identity/data-persistence.png" alt-text="Screenshot showing data persistence pane with authentication method selected.":::
170
165
171
166
> [!IMPORTANT]
172
167
> The identity defaults to the system-assigned identity if it is enabled. Otherwise, the first listed user-assigned identity is used.
173
168
>
174
169
175
-
3. Data persistence backups can now be saved to the storage account using managed identity authentication.
170
+
1. Data persistence backups can now be saved to the storage account using managed identity authentication.
176
171
177
172
:::image type="content" source="media/cache-managed-identity/redis-persistence.png" alt-text="Screenshot showing export data in Resource menu.":::
178
173
179
174
### Use managed identity to import and export cache data
180
175
181
176
1. Open your Azure Cache for Redis instance that has been assigned the Storage Blob Data Contributor role and go to the **Import** or **Export** tab under **Administration**.
182
177
183
-
2. If importing data, choose the blob storage location that holds your chosen RDB file. If exporting data, type your desired blob name prefix and storage container. In both situations, you must use the storage account you've configured for managed identity access.
178
+
1. If importing data, choose the blob storage location that holds your chosen RDB file. If exporting data, type your desired blob name prefix and storage container. In both situations, you must use the storage account you've configured for managed identity access.
3. Under **Authentication Method**, choose **Managed Identity** and select **Import** or **Export**, respectively.
182
+
1. Under **Authentication Method**, choose **Managed Identity** and select **Import** or **Export**, respectively.
188
183
189
184
> [!NOTE]
190
185
> It will take a few minutes to import or export the data.
@@ -193,7 +188,7 @@ If you're not using managed identity and instead authorizing a storage account w
193
188
> [!IMPORTANT]
194
189
>If you see an export or import failure, double check that your storage account has been configured with your cache's system-assigned or user-assigned identity. The identity used will default to system-assigned identity if it is enabled. Otherwise, the first listed user-assigned identity is used.
195
190
196
-
## Next steps
191
+
## Related content
197
192
198
193
-[Learn more](cache-overview.md#service-tiers) about Azure Cache for Redis features
199
194
-[What are managed identifies](../active-directory/managed-identities-azure-resources/overview.md)
0 commit comments