RSA HSM availability

Question

Hello!
I have a fast question: 2 years ago I associated a RSA-HSM key to my VM. Now I want switch to a new version, but i can't see any version. I can correctly choose my key vault and key, but no version apparead. Why?

Thanks in advance

Answer 1

@Momo
Thanks for the additional details and screenshots! I wasn't able to reproduce your issue as you can see in my screenshot below.

However, if you're trying to rotate your KEK, the recommended way to do so is by calling the ADE encryption script, using the same variables you used initially during encryption. For more info.

A backup is recommended prior to executing the ADE script.

For example - This was my initial script:

    $KVRGname = 'KeyVaultRG';  
        $VMRGName = 'VirtualMachineRG';  
        $vmName = 'jatranTestVM';  
        $KeyVaultName = 'KVjt';  
        $keyEncryptionKeyName = 'testADEKey';  
        $KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;  
        $diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;  
        $KeyVaultResourceId = $KeyVault.ResourceId;  
        $keyEncryptionKeyUrl = (Get-AzKeyVaultKey -VaultName $KeyVaultName -Name $keyEncryptionKeyName).Key.kid;  
        $sequenceVersion = [Guid]::NewGuid();  
          
 Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGname -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $keyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId -VolumeType "All" –SequenceVersion $sequenceVersion;  

If I were to rotate my keys, I would use the same script with the "sequence version" variable, just referencing a different key.

$KVRGname = 'KeyVaultRG';  
$VMRGName = 'VirtualMachineRG';  
$vmName = 'jatranTestVM';  
$KeyVaultName = 'KVjt';  
$keyEncryptionKeyName = 'testADEKey002';  

If you have any other questions, please let me know.
Thank you again for your time and patience throughout this issue.

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.