How to encrypt secrets stored in key vault using customer managed keys

Question

Is there any way to encrypt the secrets stored in the Azure key vault by customer-managed keys?

I want to store my secrets in the key vault but I don't want to use the default key for encryption. Can I use my own keys to encrypt the secrets? Kindly help.

Answer 1

@Kaavyan Raghavan

Thank you for posting your query on Microsoft Q&A. From above statement I concluded that you want to store and encrypt secrets in Azure Key Vault with your own keys.

Please do correct me if this is not the case.

At this point in time we could use customer managed keys for encryption only for storage blobs.

For Azure Key vault secrets as per Encryption docs:

All secrets in your Key Vault are stored encrypted. Key Vault encrypts secrets at rest with a hierarchy of encryption keys, with all keys in that hierarchy are protected by modules that are FIPS 140-2 compliant. This encryption is transparent, and requires no action from the user. The Azure Key Vault service encrypts your secrets when you add them, and decrypts them automatically when you read them. The encryption leaf key of the key hierarchy is unique to each key vault. The encryption root key of the key hierarchy is unique to the security world, and its protection level varies between regions:

• China: root key is protected by a module that is validated for FIPS 140-2 Level 1.
• Other regions: root key is protected by a module that is validated for FIPS 140-2 Level 2 or higher.

However if this is impacting your business requirements, I recommend you to post your idea on our feedback portal and let me know so that I could also vote for it.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Answer 2

• @Kaavyan Raghavan
  • Have you achieved the functionality which you asked?
    • If yes, please let me know how you did that