ARM Deployment of Synapse Analytics with CMK

Question

ARM Deployment of Synapse Analytics with CMK

Christopher Mühl 106

Hello community,

I would like to deploy an Azure Synapse Analytics Workspace using an ARM template with a Custom Managed Key.
For this I am using the latest ARM template version 2021-06-01.
https://learn.microsoft.com/en-us/azure/templates/microsoft.synapse/workspaces

Previously I have already created a KeyVault via another ARM template, deployed a key in it and have authorized a UserAssignedIdentity on the KeyVault.

Now I want to use this UserAssignedIdentity in the Synapse ARM template to retrieve the CMK from the KeyVault.

Currently my template is failing because the ManagedIdentity of the workspace and not the UserAssignedIdentity is trying to access the KeyVault.
"code": "CustomerManagedKeyPermissionMissing",
"message": "Could not perform a 'Get' operation on the workspace encryption key. Make sure that the workspace Managed Identity has 'Get', 'WrapKey' and 'UnwrapKey' access to the KeyVault through the KeyVault's Access Policies or through RBAC."

Besides the fact that I don't know how to authorize the SystemAssignedIdentity on the KeyVault when the SystemAssignedIdentity or the Workspace doesn't even exist yet, I actually just want to tell the template "Please use the UserAssignedIdentity and not the SystemAssignedIdentity".

For this I found the property "useSystemAssignedIdentity". (https://learn.microsoft.com/en-us/azure/templates/microsoft.synapse/workspaces?tabs=json#kekidentityproperties)
The property requires an object, however I expect a boolean value to be specified here and unfortunately I haven't found an example anywhere.

How must the property "useSystemAssignedIdentity" be filled, so that the UserAssignedIdentity is used for the access?

Attached is a screenshot of my current ARM template.

Thanks in advance!
Christopher

Answer 1

KranthiPakala-MSFT 35,101 Microsoft Employee

Hello @Christopher Mühl ,

Thanks for the question and using MS Q&A platform.

My understanding is that you are trying to create a synapse workspace using ARM template using UserAssingedIdentity and you are receiving above error. Please correct if I'm not accurate.

From the above error message, it complains that your UserAssignedIdentity (I know errror says Managed Identity, which means User Assigned Managed Identity with regards to your scenario) doesn't have the Get permission on the AzureKeyVault. I see you already stated that UserAssignedIdentity has already been authorized for the keyvalut, but could you please re-confirm if the below access policies/permissions are granted to it?

Get (to read the public part of a key)
WrapKey (to insert a key into Key Vault when creating a new key).
UnwrapKey (to get the key for decryption).

For more info, please refer to this doc: Using a User-assigned Managed identity

Also, could you please confirm if your Azure Key Vault is behind a firewall? The reason I would like to validate this is because a User-assigned Managed Identity cannot be configured to access customer-managed key when Azure Key Vault is behind a firewall.

Christopher Mühl 106 Reputation points

2022-02-11T08:34:04.713+00:00

Hello @KranthiPakala-MSFT ,

thank you for your answer.

I can confirm that the UserAssignedIdentity has the required permissions (Get, WrapKey and UnwrapKey) on the KeyVault.

I can also confirm that the KeyVault is behind a firewall. This is also a requirement from our security that the KeyVault must be behind a firewall.
However, in the KeyVault firewall, the option "Allow trusted Microsoft services to bypass this firewall" is enabled.

If this still doesn't work, what alternatives would I have?
Is it better to use the workspace-managed identity in this case? But how can I pre-authorize this workspace-managed identity on the KeyVault if the workspace is not yet created? (This is also a requirement of our security, which is secured by a policy. I am not allowed to create a workspace without CMK).
Christopher Mühl 106 Reputation points

2022-02-11T12:53:44.417+00:00

Oh I see that creating a workspace can be done in 2 steps. In the first step the workspace is created, then you have the possibility to authorize the managed identity on the KeyVault and then you can activate the workspace.

This solves my problem. Thanks a lot for the support!
KranthiPakala-MSFT 35,101 Reputation points Microsoft Employee

2022-02-11T21:46:53.573+00:00

Hello @Christopher Mühl ,

Gald to know that the above information was helpful to unblock you. :)

----------

Please don’t forget to Accept Answer and Up-Vote wherever the information provided helps you, this can be beneficial to other community members.

ARM Deployment of Synapse Analytics with CMK

0 additional answers

Activity