|
| 1 | +--- |
| 2 | +title: Configure customer-managed keys for encrypting your application source at rest |
| 3 | +description: Encrypt your application data in Azure Storage and deploy using Run From Package. |
| 4 | +ms.topic: article |
| 5 | +ms.date: 03/06/2020 |
| 6 | +--- |
| 7 | + |
| 8 | +## Core components |
| 9 | + |
| 10 | +Encrypting your Webapp's application data at rest requires the use of an Azure Storage Account and Azure Key Vault. |
| 11 | + |
| 12 | + - [Azure Storage provides Encryption at Rest](https://docs.microsoft.com/azure/storage/common/storage-service-encryption). You can use system-provided keys your customer managed keys. This is where your application data will be stored when it is not running in an Azure Webapp. |
| 13 | + - [Run From Package]((https://docs.microsoft.com/azure/app-service/deploy-run-package)) is a deployment feature of App Service. It allows you to deploy your site content from an Azure Storage Account |
| 14 | + - This requires an application setting with your Azure Storage Account URI and SAS key |
| 15 | + - [Key Vault References]() are a security feature of App Service. It allows you to import secrets at runtime. This will be used to encrypt the SAS-encoded URI of your Azure Storage Account. |
| 16 | + |
| 17 | +## Configure Encryption at Rest |
| 18 | + |
| 19 | +### Create an Azure Storage account. |
| 20 | + |
| 21 | + - Follow these instructions to create an Azure Storage Account and encrypt it with Customer Managed Keys. |
| 22 | + - https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption#customer-managed-keys-with-azure-key-vault |
| 23 | + |
| 24 | +### Configure Run From Package with your storage account |
| 25 | + |
| 26 | + - Add the App Setting as shown here: https://docs.microsoft.com/en-us/azure/app-service/deploy-run-package#run-from-external-url-instead |
| 27 | + - Test that this deploys correctly |
| 28 | + |
| 29 | +### Encrypt the application setting using Key Vault References |
| 30 | + - Now we will replace the App Setting with a Key Vault reference to secure the SAS-encoded URI |
| 31 | + - https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references |
| 32 | + |
| 33 | +## Summary |
| 34 | + |
| 35 | + - Overview of what we accomplished |
| 36 | + - If you want to revoke access to your data, you can either revoke access to the Key Vault or rotate storage account keys (which would invalidate SAS URI) |
| 37 | + |
| 38 | +## Frequently Asked Questions |
| 39 | + |
| 40 | +### Is there any additional charge for using Run From Package? |
| 41 | + |
| 42 | +Only the cost associated with the Azure Storage Account and any applicable egress charges. |
| 43 | + |
| 44 | +### How does Run From Package affect my Webapp? |
| 45 | + |
| 46 | +- Using Run From Package makes `wwwroot/` read-only. Your app will receive an error if it attempts to write to this directory. |
| 47 | +- TAR and GZIP formats are not supported. |
| 48 | +- This feature is not compatible with local cache. |
| 49 | + |
| 50 | +## Next steps |
| 51 | + |
| 52 | +- [Key Vault references for App Service](app-service-key-vault-references.md) |
| 53 | +- [Azure Storage encryption for data at rest](../storage/common/storage-service-encryption.md) |
0 commit comments