Edit

Configure customer-managed key (CMK) encryption within an enclave

The fastest way to deploy customer-managed keys and stay compliant with the Azure Enclave policy requiring CMK is through the Common Dependencies service catalog template.

Several types of encryption are available for securing your data on managed disks and other Azure PaaS services, including Azure Disk Encryption (ADE), Server-Side Encryption (SSE), and encryption at host. Azure Enclave's default governance and cybersecurity posture requires customer-managed key encryption for all resources deployed in an enclave.

Prerequisites for manual deployment method

  • Portal access from the Admin VM (usually 192.168.x.x/26).
    • Create a community endpoint to the Azure portal and Microsoft Azure services.
      • A default endpoint can be created within the community that defines access to common Microsoft sites and endpoints. If so, you can skip this step.
    • Create an enclave connection to the community endpoint.
  • You have the Key Vault Contributor role on the key vault or on the workload resource group that contains the key vault.

Steps in this guide

Enclave Key Vault

Azure Enclave might create or reuse a Key Vault in the enclave managed resource group for flow-log storage CMK configuration. For customer application keys and other workload resources, create the Key Vault in a workload resource group. Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys. By default, enclave contributors can upload keys, secrets, or certificates to a Key Vault deployed for the enclave and use existing Azure capabilities and design patterns from other Azure services to support CMK encryption.

The next sections provide examples of setting up CMK encryption, with more detailed instructions or articles provided.

Create a key in a Key Vault

Disk encryption sets (Windows IaaS)

Azure PaaS example (Storage account)

Create CMK from the Service Catalog (fastest and easiest)

Follow these instructions to create a key vault from the Service Catalog of validated templates for common Azure services.

Create CMK via the Portal

Alternatively, you can create a CMK through the Azure portal.

Steps in this guide

  1. Enable enclave access to the Azure portal.
  2. Sign in to the Admin VM.
  3. Open the Azure portal from the Admin VM.
  4. Assign Key Vault RBAC permissions from the Admin VM.
  5. Generate a key for CMK in Key Vault.

Enable enclave access to the Azure portal

Key vault access is restricted to the KV virtual network, so you must create the key vault key from the Azure portal from within the Admin VM.

Sign in to Admin VM

Follow these Admin VM instructions to sign in.

Open the Azure portal from the Admin VM

  1. After you sign in to the Admin VM, open Microsoft Edge (for example, via the Start menu).
  2. Go to https://portal.azure.com or the domain-specific portal URL.

Assign Key Vault RBAC permissions from Admin VM

Follow Grant permission to applications to access an Azure key vault using Azure RBAC to assign the appropriate role at the Key Vault scope. To create and manage keys for CMK encryption, assign the Key Vault Crypto Officer role to your user account.

Generate Key for CMK in Key Vault

  1. From the portal, go to the key vault and select Keys.
  2. Select Generate/Import.
  3. Enter the name for the new key.
  4. Select Create. The default options create an RSA 2048 key.
  5. Copy the key name you created.
  6. You can sign out of the Admin VM.

Create a user-assigned managed identity

Create a user-assigned managed identity for the enclave.

Further reading

  • Last updated on