Azure Data Lake Storage Gen V2 - Customer Managed Keys

Question

All,

I implemented "Customer Managed Keys" as per the link. Now, I don't know how to test it though. Can someone point me in in the right direction?

Thanks,
grajee

Answer 1

Hello @grajee ,

Thanks for the question and using MS Q&A platform.

Please, consider read these two articles from the Azure documentation. The article one describes in depth how customer managed keys work, whereas the article second do the same for customer provided keys.

In a nutshell, when you use a customer manager key you are indicating a key stored in Azure Key Vault that you want to use to encrypt/decrypt data in a storage account.

Under the hood, this key will be used to encrypt/decrypt the key that in turn will be used to actually encrypt/decrypt the data in your storage account.

This process will be performed transparently every time you interact with your storage account.

The following list explains the numbered steps in the diagram:

1. An Azure Key Vault admin grants permissions to encryption keys to a managed identity. The managed identity may be either a user-assigned managed identity that you create and manage, or a system-assigned managed identity that is associated with the storage account.
2. An Azure Storage admin configures encryption with a customer-managed key for the storage account.
3. Azure Storage uses the managed identity to which the Azure Key Vault admin granted permissions in step 1 to authenticate access to Azure Key Vault via Azure AD.
4. Azure Storage wraps the account encryption key with the customer-managed key in Azure Key Vault.
5. For read/write operations, Azure Storage sends requests to Azure Key Vault to unwrap the account encryption key to perform encryption and decryption operations.

When using customer provided keys, you need to provide the encryption key itself among certain metadata you want to use for encrypting/decrypting data when reading or writing your blob data, when performing your requests:

Hope this will help. Please let us know if any further queries.

------------------------------

• Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators