Added support for Managed HSM with CMK in EH

Author: EldertGrootenboerMS

articles/event-hubs/configure-customer-managed-key.md

@@ -2,7 +2,7 @@
 title: Configure your own key for encrypting Azure Event Hubs data at rest 
 description: This article provides information on how to configure your own key for encrypting Azure Event Hubs data rest. 
 ms.topic: conceptual
-ms.date: 08/18/2021
+ms.date: 05/13/2024
 ---
 
 # Configure customer-managed keys for encrypting Azure Event Hubs data at rest
@@ -12,7 +12,7 @@ Azure Event Hubs provides encryption of data at rest with Azure Storage Service
 > - The BYOK capability is supported by **premium** and **dedicated** tiers of Event Hubs.
 > - The encryption can be enabled only for new or empty namespaces. If the namespace contains event hubs, the encryption operation will fail.
 
-You can use Azure Key Vault to manage your keys and audit your key usage. You can either create your own keys and store them in a key vault, or you can use the Azure Key Vault APIs to generate keys. For more information about Azure Key Vault, see [What is Azure Key Vault?](../key-vault/general/overview.md)
+You can use Azure Key Vault (including Azure Key Vault Managed HSM) to manage your keys and audit your key usage. You can either create your own keys and store them in a key vault, or you can use the Azure Key Vault APIs to generate keys. For more information about Azure Key Vault, see [What is Azure Key Vault?](../key-vault/general/overview.md)
 
 This article shows how to configure a key vault with customer-managed keys by using the Azure portal. To learn how to create a key vault using the Azure portal, see [Quickstart: Create an Azure Key Vault using the Azure portal](../key-vault/general/quick-create-portal.md).
 
@@ -25,13 +25,19 @@ To enable customer-managed keys in the Azure portal, follow these steps. If you
 
     ![Enable customer managed key](./media/configure-customer-managed-key/enable-customer-managed-key.png)
 
+> [!NOTE]
+> Currently you can't configure Azure Key Vault Managed HSM through the portal. 
+
 ## Set up a key vault with keys
 After you enable customer-managed keys, you need to associate the customer managed key with your Azure Event Hubs namespace. Event Hubs supports only Azure Key Vault. If you enable the **Encryption with customer-managed key** option in the previous section, you need to have the key imported into Azure Key Vault. Also, the keys must have **Soft Delete** and **Do Not Purge** configured for the key. These settings can be configured using [PowerShell](../key-vault/general/key-vault-recovery.md) or [CLI](../key-vault/general/key-vault-recovery.md).
 
 1. To create a new key vault, follow the Azure Key Vault [Quickstart](../key-vault/general/overview.md). For more information about importing existing keys, see [About keys, secrets, and certificates](../key-vault/general/about-keys-secrets-certificates.md).
 
     > [!IMPORTANT]
     > Using customer-managed keys with Azure Event Hubs requires that the key vault have two required properties configured. They are:  **Soft Delete** and **Do Not Purge**. These properties are enabled by default when you create a new key vault in the Azure portal. However, if you need to enable these properties on an existing key vault, you must use either PowerShell or Azure CLI.
+
+# [Key Vault](#tab/Key-Vault)
+
 1. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
 
     ```azurecli-interactive
@@ -42,6 +48,22 @@ After you enable customer-managed keys, you need to associate the customer manag
     ```azurecli-interactive
     az keyvault update --name ContosoVault --resource-group ContosoRG --enable-purge-protection true
     ```
+
+# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
+
+1. To turn on both soft delete and purge protection when creating a vault, use the [az keyvault create](/cli/azure/keyvault#az-keyvault-create) command.
+
+    ```azurecli-interactive
+    az keyvault create --hsm-name ContosoVault --resource-group ContosoRG --location westus --enable-soft-delete true --enable-purge-protection true
+    ```    
+1. To add purge protection to an existing vault (that already has soft delete enabled), use the [az keyvault update](/cli/azure/keyvault#az-keyvault-update) command.
+
+    ```azurecli-interactive
+    az keyvault update --hsm-name ContosoVault --resource-group ContosoRG --enable-purge-protection true
+    ```
+
+---
+
 1. Create keys by following these steps:
     1. To create a new key, select **Generate/Import** from the **Keys** menu under **Settings**.
         
@@ -182,20 +204,7 @@ This section shows you how to create an Azure Event Hubs namespace with managed
  
 ### Grant Event Hubs namespace identity access to key vault
 
-1. Run the following command to create a key vault with **purge protection** and **soft-delete** enabled. 
-
-    ```powershell
-    New-AzureRmKeyVault -Name {keyVaultName} -ResourceGroupName {RGName}  -Location {location} -EnableSoftDelete -EnablePurgeProtection    
-    ```     
-    
-    (OR)    
-    
-    Run the following command to update an **existing key vault**. Specify values for resource group and key vault names before running the command. 
-    
-    ```powershell
-    ($updatedKeyVault = Get-AzureRmResource -ResourceId (Get-AzureRmKeyVault -ResourceGroupName {RGName} -VaultName {keyVaultName}).ResourceId).Properties| Add-Member -MemberType "NoteProperty" -Name "enableSoftDelete" -Value "true"-Force | Add-Member -MemberType "NoteProperty" -Name "enablePurgeProtection" -Value "true" -Force
-    ``` 
-2. Set the key vault access policy so that the managed identity of the Event Hubs namespace can access key value in the key vault. Use the ID of the Event Hubs namespace from the previous section. 
+1. Set the key vault access policy so that the managed identity of the Event Hubs namespace can access key value in the key vault. Use the ID of the Event Hubs namespace from the previous section. 
 
     ```powershell
     $identity = (Get-AzureRmResource -ResourceId $EventHubNamespaceId -ExpandProperties).Identity
@@ -293,6 +302,8 @@ In this step, you will update the Event Hubs namespace with key vault informatio
     > - `<KeyVaultName>` - Name of your key vault
     > - `<KeyName>` - Name of the key in the key vault
 
+# [Key Vault](#tab/Key-Vault) 
+
     ```json
     {
        "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
@@ -315,7 +326,33 @@ In this step, you will update the Event Hubs namespace with key vault informatio
           }
        }
     }
-    ```             
+    ```
+
+# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
+
+    ```json
+    {
+       "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
+       "contentVersion":"1.0.0.0",
+       "parameters":{
+          "namespaceName":{
+             "value":"<ServiceBusNamespaceName>"
+          },
+          "location":{
+             "value":"<Location>"
+          },
+          "keyName":{
+             "value":"<KeyName>"
+          },
+          "keyVaultUri":{
+             "value":"https://<KeyVaultName>.managedhsm.azure.net"
+          }
+       }
+    }
+    ```
+
+---
+
 3. Run the following PowerShell command to deploy the Resource Manager template. Replace `{MyRG}` with the name of your resource group before running the command. 
 
     ```powershell
@@ -334,27 +371,14 @@ Follow instructions from the [Create a user-assigned managed identity](../active
 > [!NOTE]
 > You can assign up to **4** user identities to a namespace. These associations are deleted when the namespace is deleted or when you pass the `identity -> type` in the template to `None`. 
 
-### Create a key vault and grant access to user-assigned identity 
-
-1. Run the following command to create a key vault with purge protection and soft-delete enabled.
-
-    ```azurepowershell-interactive
-    New-AzureRmKeyVault -Name "{keyVaultName}" -ResourceGroupName {RGName} -Location "{location}" -EnableSoftDelete -EnablePurgeProtection           
-    ```
-    
-    (OR)
-
-    Run the following command to update an existing key vault. Specify values for resource group and key vault names before running the command.
+### Ggrant access to user-assigned identity 
 
-    ```azurepowershell-interactive
-    ($updatedKeyVault = Get-AzureRmResource -ResourceId (Get-AzureRmKeyVault -ResourceGroupName {RGName} -VaultName {keyVaultName}).ResourceId).Properties| Add-Member -MemberType "NoteProperty" -Name "enableSoftDelete" -Value "true"-Force | Add-Member -MemberType "NoteProperty" -Name "enablePurgeProtection" -Value "true" -Force            
-    ```
-2. Get the **Service principal ID** for the user identity using the following PowerShell command. In the example, `ud1` is the user-assigned identity to be used for encryption.
+1. Get the **Service principal ID** for the user identity using the following PowerShell command. In the example, `ud1` is the user-assigned identity to be used for encryption.
 
     ```azurepowershell-interactive
     $servicePrincipal=Get-AzADServicePrincipal -SearchString "ud1"    
     ```
-3. Grant the user-assigned identity access to the key vault by assigning an access policy.     
+1. Grant the user-assigned identity access to the key vault by assigning an access policy.     
 
     ```azurepowershell-interactive
     Set-AzureRmKeyVaultAccessPolicy -VaultName {keyVaultName} -ResourceGroupName {RGName} -ObjectId $servicePrincipal.Id -PermissionsToKeys get,wrapKey,unwrapKey,list    
@@ -393,7 +417,6 @@ This section gives you an example that shows you how to do the following tasks u
                     }
     ```
    
-
 1. Create a JSON file named **CreateEventHubsNamespaceWithUserIdentityAndEncryption.json** with the following content:
 
     ```json
@@ -488,6 +511,8 @@ This section gives you an example that shows you how to do the following tasks u
     ```  
 1. Create a template parameter file: **CreateEventHubsNamespaceWithUserIdentityAndEncryptionParams.json**.
 
+# [Key Vault](#tab/Key-Vault) 
+
     ```json
     {
        "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
@@ -514,6 +539,36 @@ This section gives you an example that shows you how to do the following tasks u
     }
     ```
 
+# [Key Vault Managed HSM](#tab/Key-Vault-Managed-HSM)
+
+    ```json
+    {
+       "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
+       "contentVersion":"1.0.0.0",
+       "parameters":{
+          "namespaceName":{
+             "value":"<ServiceBusNamespaceName>"
+          },
+          "location":{
+             "value":"<Location>"
+          },
+          "keyVaultUri":{
+             "value":"https://<KeyVaultName>.managedhsm.azure.net"
+          },
+          "keyName":{
+             "value":"<KeyName>"
+          },
+          "identity": {
+            "value": {
+                "userAssignedIdentity": "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<USER MANAGED IDENTITY NAME>"
+            }
+         }
+       }
+    }
+    ```
+
+---
+
     In the parameter file, replace placeholders with appropriate values.
     
     | Placeholder | value |