Examkin

Question

Difficulty: MediumConfigure Storage Encryption and Customer-Managed Keys

Your company has an Azure subscription named sub-apexion-prod. You plan to configure customer-managed keys (CMK) to encrypt an Azure Storage account named saapexionpatient. You deploy an Azure Key Vault named kv-apexion-keys. The Key Vault has both soft-delete and purge protection enabled and is configured to use Azure role-based access control (RBAC) for authorization. The storage account is configured with a system-assigned managed identity. You need to grant the storage account the minimum required permissions to the key vault to enable CMK encryption. Which role should you assign to the system-assigned managed identity of the storage account?

  1. A
    Key Vault Contributor
  2. B
    Key Vault Reader
  3. Key Vault Crypto Service UserAnswer
  4. D
    Key Vault Crypto Officer

Answer

Key Vault Crypto Service User
The correct answer is Key Vault Crypto Service User. When Key Vault is configured for Azure RBAC authorization, the system-assigned managed identity of the storage account requires data plane access to perform key encryption operations (specifically wrapping and unwrapping). The Key Vault Crypto Service User role is the built-in role designed for this purpose, providing the least privilege needed.

Step-by-Step Solution

1
Identify the authentication and authorization mechanism configured on the Key Vault.
The Key Vault is configured to use Azure RBAC for authorization.
This means built-in Azure RBAC roles must be used instead of classic Key Vault access policies.
2
Determine the cryptographic operations required by the Storage Account managed identity.
The Storage Account managed identity needs permissions to wrap and unwrap keys stored in the Key Vault.
These operations are necessary for Azure Storage to encrypt and decrypt data using the customer-managed key.
3
Evaluate the roles to find the one that grants the minimum necessary permissions.
Key Vault Crypto Service User grants only the wrap and unwrap actions on keys.
Other roles either grant management-plane-only access (Key Vault Contributor, Key Vault Reader) or excessive data plane permissions (Key Vault Crypto Officer).

Key Concept

To enable customer-managed keys (CMK) for a storage account using Azure RBAC for Key Vault authorization, the storage account's managed identity must be granted the Key Vault Crypto Service User role, which provides the minimum necessary data plane permissions (wrap and unwrap keys).
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic