|
| 1 | +--- |
| 2 | +title: Create an account that supports customer-managed keys for tables and queues |
| 3 | +titleSuffix: Azure Storage |
| 4 | +description: Learn how to create a storage account that supports configuring customer-managed keys for tables and queues. Use the Azure CLI or an Azure Resource Manager template to create a storage account that relies on the account encryption key for Azure Storage encryption. You can then configure customer-managed keys for the account. |
| 5 | +services: storage |
| 6 | +author: tamram |
| 7 | + |
| 8 | +ms.service: storage |
| 9 | +ms.topic: how-to |
| 10 | +ms.date: 01/10/2020 |
| 11 | +ms.author: tamram |
| 12 | +ms.reviewer: cbrooks |
| 13 | +ms.subservice: common |
| 14 | +--- |
| 15 | + |
| 16 | +# Create an account that supports customer-managed keys for tables and queues |
| 17 | + |
| 18 | +Azure Storage encrypts all data in a storage account at rest. By default, Queue storage and Table storage use a key that is scoped to the service and managed by Microsoft. You can also opt to use customer-managed keys to encrypt queue or table data. To use customer-managed keys with queues and tables, you must first create a storage account that uses an encryption key that is scoped to the account, rather than to the service. After you have created an account that uses the account encryption key for queue and table data, you can configure customer-managed keys with Azure Key Vault for that storage account. |
| 19 | + |
| 20 | +This article describes how to create a storage account that relies on a key that is scoped to the account. When the account is first created, Microsoft uses the account key to encrypt the data in the account, and Microsoft manages the key. You can subsequently configure customer-managed keys for the account to take advantage of those benefits, including the ability to provide your own keys, update the key version, rotate the keys, and revoke access controls. |
| 21 | + |
| 22 | +## About the feature |
| 23 | + |
| 24 | +To create a storage account that relies on the account encryption key for Queue and Table storage, you must first register to use this feature with Azure. Due to limited capacity, be aware that it may take several months before requests for access are approved. |
| 25 | + |
| 26 | +You can create a storage account that relies on the account encryption key for Queue and Table storage in the following regions: |
| 27 | + |
| 28 | +- East US |
| 29 | +- South Central US |
| 30 | +- West US 2 |
| 31 | + |
| 32 | +### Register to use the account encryption key |
| 33 | + |
| 34 | +To register with Azure CLI, call the [az feature register](/cli/azure/feature#az-feature-register) command. |
| 35 | + |
| 36 | +To register to use the account encryption key with Queue storage: |
| 37 | + |
| 38 | +```azurecli |
| 39 | +az feature register --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForQueues |
| 40 | +``` |
| 41 | + |
| 42 | +To register to use the account encryption key with Table storage: |
| 43 | + |
| 44 | +```azurecli |
| 45 | +az feature register --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForTables |
| 46 | +``` |
| 47 | + |
| 48 | +### Check the status of your registration |
| 49 | + |
| 50 | +To check the status of your registration for Queue storage: |
| 51 | + |
| 52 | +```azurecli |
| 53 | +az feature show --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForQueues |
| 54 | +``` |
| 55 | + |
| 56 | +To check the status of your registration for Table storage: |
| 57 | + |
| 58 | +```azurecli |
| 59 | +az feature show --namespace Microsoft.Storage --name AllowAccountEncryptionKeyForTables |
| 60 | +``` |
| 61 | + |
| 62 | +### Re-register the Azure Storage resource provider |
| 63 | + |
| 64 | +After your registration is approved, you must re-register the Azure Storage resource provider. Call the [az provider register](/cli/azure/provider#az-provider-register) command: |
| 65 | + |
| 66 | +```azurecli |
| 67 | +az provider register --namespace 'Microsoft.Storage' |
| 68 | +``` |
| 69 | + |
| 70 | +## Create an account that uses the account encryption key |
| 71 | + |
| 72 | +You must configure a new storage account to use the account encryption key for queues and tables at the time that you create the storage account. The scope of the encryption key cannot be changed after the account is created. |
| 73 | + |
| 74 | +The storage account must be of type general-purpose v2 and must be configured for locally redundant storage (LRS). You can create the storage account and configure it to rely on the account encryption key by using either Azure CLI or an Azure Resource Manager template. |
| 75 | + |
| 76 | +> [!NOTE] |
| 77 | +> Only Queue and Table storage can be optionally configured to encrypt data with the account encryption key when the storage account is created. Blob storage and Azure Files always use the account encryption key to encrypt data. |
| 78 | +
|
| 79 | +### [Azure CLI](#tab/azure-cli) |
| 80 | + |
| 81 | +To use Azure CLI to create a storage account that relies on the account encryption key, make sure you have installed Azure CLI version 2.0.80 or later. For more information, see [Install the Azure CLI](/cli/azure/install-azure-cli). |
| 82 | + |
| 83 | +Next, create a general-purpose v2 storage account by calling the [az storage account create](/cli/azure/storage/account#az-storage-account-create) command, with the appropriate parameters: |
| 84 | + |
| 85 | +- Include the `--encryption-key-type-for-queue` option and set its value to `Account` to use the account encryption key to encrypt data in Queue storage. |
| 86 | +- Include the `--encryption-key-type-for-table` option and set its value to `Account` to use the account encryption key to encrypt data in Table storage. |
| 87 | + |
| 88 | +The following example shows how to create a general-purpose v2 storage account that is configured for LRS and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in brackets with your own values: |
| 89 | + |
| 90 | +```azurecli |
| 91 | +az storage account create \ |
| 92 | + --name <storage-account> \ |
| 93 | + --resource-group <resource-group> \ |
| 94 | + --location <location> \ |
| 95 | + --sku Standard_LRS \ |
| 96 | + --kind StorageV2 \ |
| 97 | + --encryption-key-type-for-table Account \ |
| 98 | + --encryption-key-type-for-queue Account |
| 99 | +``` |
| 100 | + |
| 101 | +### [Template](#tab/template) |
| 102 | + |
| 103 | +The following JSON example creates a general-purpose v2 storage account that is configured for LRS and that uses the account encryption key to encrypt data for both Queue and Table storage. Remember to replace the placeholder values in angle brackets with your own values: |
| 104 | + |
| 105 | +```json |
| 106 | +"resources": [ |
| 107 | + { |
| 108 | + "type": "Microsoft.Storage/storageAccounts", |
| 109 | + "apiVersion": "2019-06-01", |
| 110 | + "name": "[parameters('<storage-account>')]", |
| 111 | + "location": "[parameters('<location>')]", |
| 112 | + "dependsOn": [], |
| 113 | + "tags": {}, |
| 114 | + "sku": { |
| 115 | + "name": "[parameters('Standard_LRS')]" |
| 116 | + }, |
| 117 | + "kind": "[parameters('StorageV2')]", |
| 118 | + "properties": { |
| 119 | + "accessTier": "[parameters('<accessTier>')]", |
| 120 | + "supportsHttpsTrafficOnly": "[parameters('supportsHttpsTrafficOnly')]", |
| 121 | + "largeFileSharesState": "[parameters('<largeFileSharesState>')]", |
| 122 | + "encryption": { |
| 123 | + "services": { |
| 124 | + "queue": { |
| 125 | + "keyType": "Account" |
| 126 | + }, |
| 127 | + "table": { |
| 128 | + "keyType": "Account" |
| 129 | + } |
| 130 | + }, |
| 131 | + "keySource": "Microsoft.Storage" |
| 132 | + } |
| 133 | + } |
| 134 | + } |
| 135 | +], |
| 136 | +``` |
| 137 | + |
| 138 | +--- |
| 139 | + |
| 140 | +After you have created an account that relies on the account encryption key, see one of the following articles to configure customer-managed keys with Azure Key Vault: |
| 141 | + |
| 142 | +- [Configure customer-managed keys with Azure Key Vault by using the Azure portal](storage-encryption-keys-portal.md) |
| 143 | +- [Configure customer-managed keys with Azure Key Vault by using PowerShell](storage-encryption-keys-powershell.md) |
| 144 | +- [Configure customer-managed keys with Azure Key Vault by using Azure CLI](storage-encryption-keys-cli.md) |
| 145 | + |
| 146 | +## Verify the account encryption key |
| 147 | + |
| 148 | +To verify that the new storage account is using the account encryption key, call the Azure CLI [az storage account](/cli/azure/storage/account#az-storage-account-show) command. This command returns a list of storage account properties and their values. Look for the `keyType` property and verify that it is set to `Account`. |
| 149 | + |
| 150 | +```azurecli |
| 151 | +az storage account show / |
| 152 | + --name <storage-account> / |
| 153 | + --resource-group <resource-group> |
| 154 | +``` |
| 155 | + |
| 156 | +## Next steps |
| 157 | + |
| 158 | +- [Azure Storage encryption for data at rest](storage-service-encryption.md) |
| 159 | +- [What is Azure Key Vault](https://docs.microsoft.com/azure/key-vault/key-vault-overview)? |
0 commit comments