Encryption for Azure Storage Accounts

On this page:

Introduction to Storage Encryption

Azure Storage automatically encrypts all data written to it using storage account encryption. This encryption is applied at the storage account level and protects your data at rest, ensuring confidentiality and compliance. Azure Storage encryption uses 256-bit AES encryption, one of the strongest block ciphers available.

This document provides an in-depth look at the encryption mechanisms available for Azure Storage accounts, including service-managed and customer-managed key options.

Service-Managed Keys (Default)

By default, Azure Storage uses service-managed keys for encryption. This means Azure manages the encryption keys and their storage on your behalf. This is the simplest and most common approach, offering zero management overhead for key rotation and security.

  • Simplicity: No configuration required from the user.
  • Security: Keys are stored securely by Azure.
  • Automatic Rotation: Azure handles key rotation automatically.

Note: Service-managed keys are enabled by default for all new and existing storage accounts. You do not need to take any action to utilize this encryption.

Customer-Managed Keys

For enhanced control and compliance, Azure Storage also supports customer-managed keys. With this option, you provide and manage your own encryption keys using Azure Key Vault. This allows you to control key rotation, revoke access, and maintain a cryptographic audit trail.

Benefits of Customer-Managed Keys:

  • Full Control: You control the lifecycle of your encryption keys.
  • Auditing: Integrate with Azure Key Vault for auditing key usage.
  • Compliance: Meet stringent compliance requirements that mandate customer control over keys.

Enabling Customer-Managed Keys:

To enable customer-managed keys, you must have an Azure Key Vault instance configured. Follow these general steps:

  1. Create or select an existing Azure Key Vault.
  2. Grant the storage account's managed identity access to the Key Vault.
  3. Configure the storage account to use a key from the Key Vault.

For detailed instructions, refer to the Key Management section.

Learn More About Customer-Managed Keys

How Encryption Works

When data is written to Azure Storage, it is encrypted before being written to disk. When data is read, it is decrypted on the fly. This process is transparent to applications accessing the storage account.

The encryption process involves:

  • Data Encryption: Data is encrypted using strong cryptographic algorithms.
  • Key Management: Encryption keys are securely managed, either by Azure (service-managed) or by the customer (customer-managed).
  • Key Wrapping: For customer-managed keys, the data encryption key (DEK) is wrapped by a key encryption key (KEK) stored in Azure Key Vault.
// Simplified representation of data flow
data_to_write = "My sensitive data"
encrypted_data = encrypt(data_to_write, DEK)
write_to_disk(encrypted_data)

encrypted_data_from_disk = read_from_disk()
decrypted_data = decrypt(encrypted_data_from_disk, DEK)
// Use decrypted_data

Key Management and Azure Key Vault

Azure Key Vault is a cloud service for securely storing and accessing secrets. It is essential for managing customer-managed keys for Azure Storage encryption.

Key Operations in Key Vault:

  • Key Creation/Import: Create new keys or import existing keys.
  • Key Rotation: Schedule and perform key rotation.
  • Access Policies: Define granular permissions for who can access keys.
  • Key Vault Integration: Connect your storage account to Key Vault for encryption/decryption operations.

Tip: Regularly review Key Vault access policies and key rotation schedules to ensure optimal security and compliance.

To configure customer-managed keys:

  1. Ensure your storage account has a system-assigned managed identity enabled.
  2. Grant the storage account's managed identity the "Get", "Wrap Key", and "Unwrap Key" permissions on your Azure Key Vault.
  3. In the storage account's encryption settings, select "Customer-managed keys" and specify the Key Vault URI and Key Name.
Azure Documentation on Encryption

Next Steps

Understand the encryption options available for your Azure Storage accounts. Choose the method that best suits your security, compliance, and management requirements.