I am learning about Azure Blob storage using the Microsoft documentation. When I came across this page
https://docs.microsoft.com/en-us/learn/modules/explore-azure-blob-storage/4-blob-storage-security
I found there are 3 types of key management in encryption
I am unable to understand the differences between the last two. Does the key provided by Microsoft in case of customer managed key?
Please help
Thanks in advance
Please, consider read these two articles from the Azure documentation. The first one describes in depth how customer managed keys work, whereas the second do the same for customer provided keys.
In a nutshell, when you use a customer manager key you are indicating a key stored in Azure Key Vault that you want to use to encrypt/decrypt data in a storage account.
Under the hood, this key will be used to encrypt/decrypt the key that in turn will be used to actually encrypt/decrypt the data in your storage account.
This process will be performed transparently every time you interact with your storage account.
It is very well described in the first article I cited:
- An Azure Key Vault admin grants permissions to encryption keys to the managed identity that's associated with the storage account.
- An Azure Storage admin configures encryption with a customer-managed key for the storage account.
- Azure Storage uses the managed identity that's associated with the storage account to authenticate access to Azure Key Vault via Azure Active Directory.
- Azure Storage wraps the account encryption key with the customer-managed key in Azure Key Vault.
- For read/write operations, Azure Storage sends requests to Azure Key Vault to unwrap the account encryption key to perform encryption and decryption operations.
On the contrary, when using customer provided keys, you need to provide the encryption key itself among certain metadata you want to use for encrypting/decrypting data when reading or writing your blob data, when performing your requests:
Again, now from the second document I cited:
When a client application provides an encryption key on the request, Azure Storage performs encryption and decryption transparently while reading and writing blob data. Azure Storage writes an SHA-256 hash of the encryption key alongside the blob's contents. The hash is used to verify that all subsequent operations against the blob use the same encryption key.
When a client creates or updates a blob using a customer-provided key on the request, then subsequent read and write requests for that blob must also provide the key.
To send the encryption key as part of the request, a client must establish a secure connection to Azure Storage using HTTPS.
This article could be of help as well.
