Customer Managed Keys
Skill up on using Customer Managed Keys with Azure Key Vault Premium and Managed HSM, and how they combine with encrypted storage in Azure services, plus Azure Confidential Computing and Secure Key Release.
Overview
Controlling your encryption keys is one of the most tangible ways to demonstrate data sovereignty on Azure. In this series we will be using Customer Managed Keys (CMKs) to protect data at rest and in use across a range of Azure services.
Scroll down for a fuller introduction in a sovereign context
Sovereignty scenarios
THe use of Customer Managed Keys is tightly aligned to the appropriate level of workload sovereignty. Here we will take a look at the levels used in sovereign frameworks.
Key management options
Azure Key Vault Standard, Azure Key Vault Premium, and Azure Key Vault Managed HSM each offer a different balance of security, sovereignty, and cost. Here is how to choose.
🧪 Azure Key Vault Premium
Lab to create an Azure Key Vault Premium and generate keys for use in the later labs. Also links through to the Bring Your Own Key (BYOK) pages if you wish to import a key rather than generate.
L2: Encryption at rest with CMK
Customer-Managed Keys can be used to protect data at rest across a wide range of Azure services. Here we cover five common services, the CMK integration pattern for each, and differences between Azure Key Vault Premium and Azure Key Vault Managed HSM.
🧪 CMK for Storage
Create a key in the Azure Key Vault Premium and then encrypt an Azure Storage account.
🧪 CMK for VM Disks and AKS
Use a Disk Encryption Set and an HSM-backed CMK to encrypt VM managed disks and AKS node OS disks. The second of three challenge-style labs.
Note that this series will be released in phases.