Encrypt existing storage account using customer managed key via ARM template

Anonymous

Hi,

I'm using Azure Lighthouse and there is a limitation that we cannot perform data action via MSP credentials in customer subscription.
I have a requirement to encrypt Storage account with customer managed key via ARM Template.

I found some solution which shows to create storage account first and then encrypt however our requirement is to read existing storage account (created via MSP) and encrypt with CMK since we have setup ARM permission in KeyVault.

VM encryption is working fine via ARM and got stuck in storage account.

Thanks in advance..!

SaiKishor-MSFT 17,236 Reputation points

2022-09-09T19:19:41.87+00:00

@RakeshSharma-8583 I apologize for the delay in responding to your question. I see that you are having issues with encrypting storage account with CMK via ARM Template. What error do you see when it gets stuck?
Anonymous

2022-09-12T07:33:53.487+00:00

Hi Sai,

Pelase find gteh attached error.

Error says can't access KV seems to be Lighthouse limitation, can it be done via ARM template to encrypt existing storage account via CMK.
SaiKishor-MSFT 17,236 Reputation points

2022-09-20T20:19:19.66+00:00

@RakeshSharma-8583 Can you try inserting the existing Storage Account Name here between <> and see if that helps? Thanks!

az group deployment create --resource-group $rgName --template-file storage_step2.json --parameters storageAccountName=<storageaccountname> \
keyvaultname=$vaultname keyname=$keyname keyversion=$version
SaiKishor-MSFT 17,236 Reputation points

2022-09-21T23:20:15.34+00:00

@RakeshSharma-8583 Any update?
Anonymous

2022-09-22T06:52:41.99+00:00

@SaiKishor-MSFT - Please help me storage-step2.json file, I will try and update you.

1 answer

JamesTran-MSFT 36,626 Reputation points Microsoft Employee

2022-09-22T18:16:26.227+00:00

@RakeshSharma-8583
Thank you for your time and patience on this!

From your screenshot, can open the Failed to grant access to Key Vault message and see if there's a full error message?

You can also try to get the full error message by Collecting a network trace with Fiddler, or by using the built-in network trace feature in your browser. Please keep in mind that a network trace contains the full contents of every message sent. Never post raw network traces from production apps to public forums.

A key thing to look out for when using Fiddler or your browser is any 401, 403, or 429 error codes that you might be getting when trying to grant access to the Key Vault.

Additional Link:
Common error codes for Azure Key Vault

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Please sign in to rate this answer.
Anonymous

2022-09-26T09:56:31.687+00:00

Hi @JamesTran-MSFT

Thanks to you and Sumanth for reaching out to me. I will share the logs soon however would like to give background about this request is that we have Lighthouse implementation and managing customer tenant via MSP tenant.
When we use MSP credentials, as per Limitation of Lighthouse ( Data Action) we are unable to do encryption viua portal or CLI.
However we found one workaround, if we enable Resources Access "Azure Resource Manager for template deployment" in keyvault then we can encrypt disk using ARM and same I've tested for VMs.

Now, I would like to do same for existing storage account to encrypt via CMK but no luck.

Hope I'm able to explain the issues.

JamesTran-MSFT 36,626 Reputation points Microsoft Employee

2022-10-03T23:09:40.793+00:00

@RakeshSharma-8583
Thank you for following up on this!

When it comes to an ARM template deployment to enable customer-managed keys for a storage account, I wasn't able to find any documentation on whether this would be possible or not. But from my own Storage Account, I exported the template which contained the "encryption" properties, which you can try setting to see if that works for your ARM template deployment.

From your initial error message - Failed to grant access to Key Vault, when it comes to your Key Vault, does your vault have any network restrictions that could be causing this issue? Have you tried encrypting with other Storage Accounts to see if you're running into the same issue?

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Anonymous

2022-10-06T07:23:33.837+00:00

Hi @JamesTran-MSFT

Sorry for late reply, I will give a try and let you know.

I've a ARM to encrypt the new storage account with CMK using Lighthouse however unable to make this run for existing storage account.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Encrypt existing storage account using customer managed key via ARM template

1 answer

Your answer