In backup/copy blob storage scenario, Should I consider the encryption setting in different blob?

Siqing Zheng 110

Hi,

In backup/copy blob storage scenario, Should I consider the encryption setting?

like I have two blob storage in two different region and subscriptions, with encryption configured two different CMEK(two different Application and user-assigned identity) from customer.

And I want to copy/backup one blob storage to the other one, is there any limit about the encryption? Should those two blob storage use same application or same user-assigned identity?

I checked the blob copy goalng SDK, looks there is no related option, so maybe we don't need to care about it, azure will handle by it self?

Marilee Turscak-MSFT 35,621 Reputation points Microsoft Employee

2024-06-17T18:00:33.2833333+00:00

Hi @Siqing Zheng , we are looking into your question and will get back to you shortly.
Marilee Turscak-MSFT 35,621 Reputation points Microsoft Employee

2024-06-17T20:40:43.18+00:00

@Siqing Zheng My understanding is that the encryption scope would need to be set to a container, and then it will serve as the default scope for all blobs within the container. But I'm looping in my colleagues from the Storage team to address your scenario. https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-manage?tabs=portal
Siqing Zheng 110 Reputation points

2024-06-17T21:15:03.3566667+00:00

container? but those two blobs is in defferent subscription different resource group, which means different storage accounts.

let's me re-phrase my question.
There are two independent blobs (different subscription, different storage accounts, different region.. BUT in same tenant). Both storage account configured CMEK Encryption with two different key vault keys.

NOW, I need to perform backup action with golang SDK, which copy all object from one blob to an other one, question is: Is there any limit or restrictions to do that? Since two storage accounts got different keys. (in AWS, the SDK copyObject function has field for original key, and dest key) So, I would like to know if Azure need some special config (azure got more things like application, user-assigned identity realted to the CMEK)? or Azure handle inside, since Azure has all information about both storage account?
Siqing Zheng 110 Reputation points

2024-06-18T16:54:26.2566667+00:00

Hi @Marilee Turscak-MSFT , is there any update on this one? Thanks

Share via

In backup/copy blob storage scenario, Should I consider the encryption setting in different blob?