Examkin

Question

Difficulty: MediumConfigure Storage Encryption and Customer-Managed Keys

Luminary Financials has an Azure subscription named sub-luminary-prod. The subscription contains the following resources:

* An Azure Storage account named saluminarydata configured to use a user-assigned managed identity named uami-storage-enc for encryption.
* An Azure Key Vault named kv-luminary-keys that has soft-delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) for authorization.

You need to configure saluminarydata to encrypt its data using a customer-managed key stored in kv-luminary-keys by using the uami-storage-enc identity.

Which role assignment is required on kv-luminary-keys to successfully configure the storage encryption?

  1. A
    Assign the Key Vault Contributor role to the uami-storage-enc identity
  2. Assign the Key Vault Crypto Service User role to the uami-storage-enc identityAnswer
  3. C
    Assign the Key Vault Crypto Service User role to the saluminarydata system-assigned identity
  4. D
    Assign the Key Vault Reader role to the uami-storage-enc identity

Answer

Assign the Key Vault Crypto Service User role to the uami-storage-enc identity
To configure storage account encryption with customer-managed keys (CMK) using a user-assigned managed identity when the Key Vault uses Azure RBAC, the identity must be granted data-plane permissions. Assigning the Key Vault Crypto Service User role to the user-assigned managed identity is the correct approach because it provides the required permissions to perform key wrap and unwrap operations.

Step-by-Step Solution

1
Identify the managed identity configured on the storage account for encryption purposes.
The identity is the user-assigned managed identity named uami-storage-enc.
Permissions must be granted to the specific identity that the storage account uses to authenticate against the Key Vault.
2
Determine the authorization model of the Key Vault.
The Key Vault kv-luminary-keys uses Azure role-based access control (Azure RBAC) for authorization.
Knowing the authorization model determines whether you need to configure Key Vault Access Policies or assign Azure RBAC roles.
3
Determine the minimum role that grants key wrap and unwrap operations.
The Key Vault Crypto Service User role provides the necessary data-plane permissions to perform wrap and unwrap operations on keys.
Following the principle of least privilege, the Key Vault Crypto Service User role is sufficient for storage account encryption, whereas Key Vault Contributor is a control-plane role and does not grant key access.

Key Concept

To configure customer-managed keys (CMK) for Azure Storage encryption when the target Key Vault uses Azure RBAC, the identity used by the storage account must be assigned the Key Vault Crypto Service User role on the Key Vault. This role grants data-plane permissions (specifically wrap and unwrap key actions) required for encryption.
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic