PMK / CMK keys

Az Student 1

I know when you create a CMK for vm encryption you create a KV that a DES policy will pull from. Thus, if I spin up / deploy 1,000 vm's that a particular DES, all 1,000 will have they same encryption key. I know you can create multiple KV/DES policies with different CMKs, etc.. But my questions is how are PMK handled in this scenario? For example, if I spin up / deploy 1,000 vm's just using the default SSE/PMK do all 1,000 get the same PMK or is there some algorithm that generates a unique key for each vm, for each set of 10 vm's, etc???

Thanks in advance

1 answer

SaiKishor-MSFT 17,236 Reputation points

2022-12-08T00:00:39.753+00:00

@Az Student Thank you for reaching out to Microsoft Q&A. I understand that you are having questions regarding PMK and if it can be used for multiple VMs.

It is possible that disks in the same subscription can share the same PMK. However, we don't share PMKs between different subscriptions unless you move the disks to another subscription yourself. Hope this answers your question.

Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.
Please sign in to rate this answer.
Az Student 1 Reputation point

2022-12-08T16:30:11.263+00:00

So, if I understand your statement...

MS doesn't share PMK's between subscriptions BUT a Key within a subscription KEYS "CAN" be shared. The last part of that statement is what I am trying to get clarity on.

for this discussion lets assume we only have a single subscription and have 1,000 vm. If I create 5 RG under that subscription and deploy 200 vm's to each RG, how many PMK's would be used for those 1,000 vm's? Will it be a single PMK for all vm's or will each vm have a unique KEY or is there some algorithm that says for every 10 or 100 vm's use Key A, the next 100 vm's use KEY B, etc...

OR

Say if a MS PMK, say KEY A was compromised, how many vm's would be effected by that compromise?

Thanks

SaiKishor-MSFT 17,236 Reputation points

2022-12-09T22:56:34.313+00:00

We generate multiple keys for each subscription. Typically, we share a key with max 20 disks in a subscription.

Please let me know if you have more questions. I will happy to answer. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Mike Berry 0 Reputation points

2023-01-25T16:03:21.3633333+00:00

Had one additional follow up question, how often do the PMK get rotated? I see some that reference within a year but nothing concrete.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

PMK / CMK keys

1 answer

Your answer