Can we apply HSM key across different subscription. Can that be applied on Storage Accounts, SQL Server that are in a different subscription.

Question

Can I use one single Managed HSM Key Vault resource for different environments say Dev and Uat which are in different subscriptions. If yes, how?. Can I use or apply one single key for storage accounts in both Dev and Uat in different subscriptions. Is it possible. Or should I create seperate keys for Dev and Uat. Please help.

Answer 1

In Azure, using a single Managed HSM (Hardware Security Module) Key Vault resource across different subscriptions, including for services like Storage Accounts, SQL Server, and others, is feasible under certain conditions. Azure allows resources in one subscription to access resources in another subscription, provided they are under the same Azure Active Directory tenant. This means you can use a Managed HSM Key Vault in one subscription (e.g., a production environment) and access it from another subscription (for example a development environment).

You need to configure access policies and RBAC in your Key Vault to grant the necessary permissions to the identities (like user accounts, service principals, or managed identities) in the different subscriptions. This involves assigning roles that allow these identities to manage or use keys, secrets, or certificates in the Key Vault.

You can use Key Vault references for services like Azure SQL Database, Storage Accounts, or Cosmos DB to utilize the keys stored in Key Vault. This means you can have a single key in your HSM Key Vault and reference it in different Azure services across subscriptions.