I am working on this project where I want to use a azure json template to create a Storage Account, Keyvault and a Key and encrypt the storage account With this key.
So far i have this code:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vaultName": {
"type": "string",
"metadata": {
"description": "The name of the key vault to be created."
}
},
"skuName": {
"type": "string",
"defaultValue": "Standard",
"allowedValues": [
"Standard",
"Premium"
],
"metadata": {
"description": "The SKU of the vault to be created."
}
},
"keyName": {
"type": "string",
"metadata": {
"description": "The name of the key to be created."
}
},
"keyType": {
"type": "string",
"metadata": {
"description": "The JsonWebKeyType of the key to be created."
}
},
"keyOps": {
"type": "array",
"defaultValue": [],
"metadata": {
"description": "The permitted JSON web key operations of the key to be created."
}
},
"keySize": {
"type": "int",
"defaultValue": 2048,
"metadata": {
"description": "The size in bits of the key to be created."
}
},
"curveName": {
"type": "string",
"defaultValue": "",
"metadata": {
"description": "The JsonWebKeyCurveName of the key to be created."
}
},
"tenantId": {
"type": "string",
"defaultValue": "[subscription().tenantId]",
"metadata": {
"description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet."
}
},
"objectId": {
"type": "string",
"defaultValue": "<My-Account-Object-Id",
"metadata": {
"description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets."
}
},
"secretsPermissions": {
"type": "array",
"defaultValue": [
"list",
"get"
],
"metadata": {
"description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge."
}
},
"keyPermissions": {
"type": "array",
"defaultValue": [
"list",
"get"
],
"metadata": {
"description": "Specifies the permissions to key in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge."
}
},
"storageAccountType": {
"type": "string",
"defaultValue": "Standard_LRS",
"allowedValues": [
"Standard_LRS",
"Standard_GRS",
"Standard_ZRS",
"Premium_LRS"
],
"metadata": {
"description": "Storage Account type"
}
},
"storageName": {
"type": "string",
"metadata": {
"description": "The name of the storage account"
}
}
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"name": "[parameters('vaultName')]",
"location": "[resourceGroup().location]",
"properties": {
"enableRbacAuthorization": false,
"enableSoftDelete": true,
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"tenantId": "[subscription().tenantId]",
"accessPolicies": [
{
"tenantId": "[parameters('tenantId')]",
"objectId": "[parameters('objectId')]",
"permissions": {
"secrets": "[parameters('secretsPermissions')]",
"keys": "[parameters('keyPermissions')]"
}
}
],
"sku": {
"name": "[parameters('skuName')]",
"family": "A"
},
"networkAcls": {
"defaultAction": "Allow",
"bypass": "AzureServices"
}
}
},
{
"type": "Microsoft.KeyVault/vaults/Keys",
"apiVersion": "2019-09-01",
"name": "[concat(parameters('vaultName'), '/', parameters('keyName'))]",
"location": "[resourceGroup().location]",
"properties": {
"kty": "[parameters('keyType')]",
"keyOps": "[parameters('keyOps')]",
"keySize": "[parameters('keySize')]",
"curveName": "[parameters('curveName')]"
}
},
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2019-06-01",
"name": "[parameters('storageName')]",
"location": "[resourceGroup().location]",
"identity": {
"type": "SystemAssigned"
},
"sku": {
"name": "[parameters('storageAccountType')]"
},
"kind": "StorageV2",
"properties": {
"encryption": {
"keySource": "Microsoft.Keyvault",
"keyvaultproperties": {
"keyvaulturi": "[reference(resourceId('Microsoft.KeyVault/vaults',parameters('vaultName')),'2016-10-01', 'full').properties.vaultUri]",
"keyname": "[parameters('keyName')]",
"keyversion": ""
},
"services": {
"blob": {"enabled": true},
"file": {"enabled": true}
}
}
}
}
],
"outputs": {
"proxyKey": {
"type": "object",
"value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]"
}
}
}
When I run the code, i got the following error:
Deployment failed. Correlation ID: f0636fa8-60f5-42d9-a47d-856438e51282. {
"error": {
"code": "FeatureNotSupportedForAccount",
"message": "Missing pre-requisites to enable EncryptionAtRest/Customer Managed Key for this storage account. For more information, see - https://aka.ms/storagecmkconfiguration"
}
}
I couldnt find any solution to help me to solve this issue. Please if anyone can help me out, i will be gratefull.