You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/cloud-hsm/authentication.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ Authentication is a crucial aspect of securely accessing and operating within Az
15
15
16
16
## Cloud HSM CLI authentication
17
17
18
-
You can authenticate by using CLI tools like `azcloudhsm_util` in either interactive mode or single-command mode. In interactive mode, use the `login` command. For single-command mode, include `singlecmd` and parameters for `loginHSM`. We advise you to securely store your HSM credentials when your application isn't using them.
18
+
You can authenticate by using CLI tools like `azcloudhsm_util` in either interactive mode or single-command mode. In interactive mode, use the `loginHSM` command. For single-command mode, include `singlecmd` and parameters for `loginHSM`. We advise you to securely store your HSM credentials when your application isn't using them.
Copy file name to clipboardExpand all lines: articles/key-vault/keys/how-to-configure-key-rotation.md
+40-35Lines changed: 40 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,65 +14,68 @@ ms.author: mbaldwin
14
14
15
15
# Configure cryptographic key auto-rotation in Azure Key Vault
16
16
17
-
## Overview
18
-
Automated cryptographic key rotation in [Key Vault](../general/overview.md) allows users to configure Key Vault to automatically generate a new key version at a specified frequency. To configure rotation you can use key rotation policy, which can be defined on each individual key.
17
+
By automating cryptographic key rotation in [Key Vault](../general/overview.md), you can set up Key Vault to automatically create a new key version at a chosen frequency. To set up rotation, use the key rotation policy, which you can define for each individual key.
19
18
20
-
Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.
19
+
To follow cryptographic best practices, rotate encryption keys at least every two years.
21
20
22
-
For more information about how objects in Key Vault are versioned, see [Key Vault objects, identifiers, and versioning](../general/about-keys-secrets-certificates.md#objects-identifiers-and-versioning). For a comprehensive understanding of autorotation concepts across different asset types in Azure Key Vault, see [Understanding autorotation in Azure Key Vault](../general/autorotation.md).
21
+
For more information about how Key Vault versions objects, see [Key Vault objects, identifiers, and versioning](../general/about-keys-secrets-certificates.md#objects-identifiers-and-versioning). For a comprehensive understanding of autorotation concepts across different asset types in Azure Key Vault, see [Understanding autorotation in Azure Key Vault](../general/autorotation.md).
23
22
24
23
## Integration with Azure services
25
-
This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers end-to-end rotation.
24
+
25
+
This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Check the specific Azure service documentation to see if the service supports end-to-end rotation.
26
+
27
+
> [!NOTE]
28
+
> When you rotate customer-managed keys that Azure services use, the time it takes for each service to detect and apply the new key version varies (from one hour to 24 hours or more). Consult the specific Azure service documentation for guidance on when you can safely disable the old key version after rotation.
26
29
27
30
For more information about data encryption in Azure, see:
28
31
-[Azure Encryption at Rest](/azure/security/fundamentals/encryption-atrest#azure-encryption-at-rest-components)
29
32
-[Azure services data encryption support table](/azure/security/fundamentals/encryption-models#supporting-services)
30
33
31
34
## Pricing
32
35
33
-
There's an additional cost per scheduled key rotation. For more information, see [Azure Key Vault pricing page](https://azure.microsoft.com/pricing/details/key-vault/)
36
+
There's an extra cost for each scheduled key rotation. For more information, see the [Azure Key Vault pricing page](https://azure.microsoft.com/pricing/details/key-vault/).
34
37
35
38
## Permissions required
36
39
37
-
Key Vault key rotation feature requires key management permissions. You can assign a "Key Vault Crypto Officer" role to manage rotation policy and on-demand rotation.
40
+
The Key Vault key rotation feature requires key management permissions. Assign the **Key Vault Crypto Officer** role to manage the rotation policy and on-demand rotation.
38
41
39
-
For more information on how to use Azure RBAC for Key Vault and assign Azure roles, see [Use an Azure RBAC to control access to keys, certificates and secrets](../general/rbac-guide.md)
42
+
For more information on how to use Azure RBAC for Key Vault and assign Azure roles, see [Use an Azure RBAC to control access to keys, certificates and secrets](../general/rbac-guide.md).
40
43
41
44
> [!NOTE]
42
-
> If you use an access policies permission model, it is required to set 'Rotate', 'Set Rotation Policy', and 'Get Rotation Policy' key permissions to manage rotation policy on keys.
45
+
> If you use the access policies permission model, set the 'Rotate', 'Set Rotation Policy', and 'Get Rotation Policy' key permissions to manage the rotation policy on keys.
43
46
44
47
## Key rotation policy
45
48
46
-
The key rotation policy allows users to configure rotation and Event Grid notifications near expiry notification.
49
+
The key rotation policy allows you to configure rotation and Event Grid notifications for near expiry notification.
47
50
48
51
Key rotation policy settings:
49
52
50
-
- Expiry time: key expiration interval. It's used to set expiration date on newly rotated key. It doesn't affect a current key.
51
-
- Enabled/disabled: flag to enable or disable rotation for the key
53
+
- Expiry time: key expiration interval. It sets the expiration date on the newly rotated key. It doesn't affect the current key.
54
+
- Enabled/disabled: flag to enable or disable rotation for the key.
52
55
- Rotation types:
53
-
- Automatically renew at a given time after creation (default)
56
+
- Automatically renew at a given time after creation (default).
54
57
- Automatically renew at a given time before expiry. It requires 'Expiry Time' set on rotation policy and 'Expiration Date' set on the key.
55
-
- Rotation time: key rotation interval, the minimum value is seven days from creation and seven days from expiration time
58
+
- Rotation time: key rotation interval. The minimum value is seven days from creation and seven days from expiration time.
56
59
- Notification time: key near expiry event interval for Event Grid notification. It requires 'Expiry Time' set on rotation policy and 'Expiration Date' set on the key.
57
60
58
61
> [!IMPORTANT]
59
-
> Key rotation generates a new key version of an existing key with new key material. Target services should use versionless key uri to automatically refresh to latest version of the key. Ensure that your data encryption solution stores versioned key uri with data to point to the same key material for decrypt/unwrap as was used for encrypt/wrap operations to avoid disruption to your services. All Azure services are currently following that pattern for data encryption.
62
+
> Key rotation generates a new key version of an existing key with new key material. Target services should use versionless key URI to automatically refresh to the latest version of the key. Ensure that your data encryption solution stores versioned key URI with data to point to the same key material for decrypt/unwrap as was used for encrypt/wrap operations to avoid disruption to your services. All Azure services currently follow that pattern for data encryption.
Set rotation policy using Azure Powershell[Set-AzKeyVaultKeyRotationPolicy](/powershell/module/az.keyvault/set-azkeyvaultkeyrotationpolicy) cmdlet.
115
+
Set the rotation policy by using the Azure PowerShell[Set-AzKeyVaultKeyRotationPolicy](/powershell/module/az.keyvault/set-azkeyvaultkeyrotationpolicy) cmdlet.
Configuration of expiry notification for Event Grid key near expiry event. In case when automated rotation cannot be used, like when a key is imported from local HSM, you can configure near expiry notification as a reminder for manual rotation or as a trigger to custom automated rotation through integration with Event Grid. You can configure notification with days, months and years before expiry to trigger near expiry event.
149
+
You can configure an expiry notification for the Event Grid key near expiry event. If automated rotation can't be used, like when a key is imported from local HSM, you can configure near expiry notification as a reminder for manual rotation or as a trigger to custom automated rotation through integration with Event Grid. You can set the notification to trigger the near expiry event days, months, or years before the key expires.
For more information about Event Grid notifications in Key Vault, see
149
-
[Azure Key Vault as Event Grid source](/azure/event-grid/event-schema-key-vault?tabs=event-grid-event-schema)
154
+
[Azure Key Vault as Event Grid source](/azure/event-grid/event-schema-key-vault?tabs=event-grid-event-schema).
150
155
151
-
## Configure key rotation with ARM template
156
+
## Configure key rotation by using ARM template
152
157
153
-
Key rotation policy can also be configured using ARM templates.
158
+
You can configure the key rotation policy by using ARM templates.
154
159
155
160
> [!NOTE]
156
-
> It requires 'Key Vault Contributor' role on Key Vault configured with Azure RBAC to deploy key through control plane.
161
+
> To deploy a key through the control plane, you need the **Key Vault Contributor** role on the Key Vault configured with Azure RBAC.
157
162
158
163
```json
159
164
{
@@ -238,25 +243,25 @@ Key rotation policy can also be configured using ARM templates.
238
243
239
244
## Configure key rotation policy governance
240
245
241
-
Using the Azure Policy service, you can govern the key lifecycle and ensure that all keys are configured to rotate within a specified number of days.
246
+
By using the Azure Policy service, you can govern the key lifecycle and ensure that all keys are configured to rotate within a specified number of days.
242
247
243
248
### Create and assign policy definition
244
249
245
-
1.Navigate to Policy resource
250
+
1.Go to the Policy resource.
246
251
1. Select **Assignments** under **Authoring** on the left side of the Azure Policy page.
247
252
1. Select **Assign policy** at the top of the page. This button opens to the Policy assignment page.
248
253
1. Enter the following information:
249
-
- Define the scope of the policy by choosing the subscription and resource group over which the policy will be enforced. Select by clicking the three-dot button at on **Scope** field.
254
+
- Define the scope of the policy by choosing the subscription and resource group over which the policy is enforced. Select by clicking the three-dot button at on **Scope** field.
250
255
- Select the name of the policy definition: "[Keys should have a rotation policy ensuring that their rotation is scheduled within the specified number of days after creation.
- Go to the **Parameters** tab at the top of the page.
253
258
- Set **The maximum days to rotate** parameter to desired number of days for example, 730.
254
259
- Define the desired effect of the policy (Audit, or Disabled).
255
-
1. Fill out any additional fields. Navigate the tabs clicking on **Previous** and **Next** buttons at the bottom of the page.
256
-
1. Select **Review + create**
257
-
1. Select **Create**
260
+
1. Fill out any additional fields. Navigate the tabs by clicking on **Previous** and **Next** buttons at the bottom of the page.
261
+
1. Select **Review + create**.
262
+
1. Select **Create**.
258
263
259
-
Once the built-in policy is assigned, it can take up to 24 hours to complete the scan. After the scan is completed, you can see compliance results like below.
264
+
After you assign the built-in policy, it can take up to 24 hours to complete the scan. When the scan finishes, you can see compliance results like the following.
260
265
261
266
:::image type="content" source="../media/keys/key-rotation/key-rotation-policy.png" alt-text="Screenshot of key rotation policy compliance." lightbox="../media/keys/key-rotation/key-rotation-policy.png":::
0 commit comments