Zenix Solutions has an Azure subscription named sub-zenix-prod. You deploy an Azure Storage account named sazenixprod and an Azure Key Vault named kv-zenix-secure.
The Key Vault is configured as follows:
- Permission model: Azure role-based access control (Azure RBAC)
- Soft-delete: Enabled
- Purge protection: Enabled
You create a user-assigned managed identity named uami-zenix-storage. You plan to configure customer-managed keys (CMK) for encryption on sazenixprod using uami-zenix-storage to access the keys in kv-zenix-secure.
Which two actions should you perform to configure customer-managed key encryption? Select two.
- Associate the user-assigned managed identity uami-zenix-storage with the storage account sazenixprod.Answer
- Assign the Key Vault Crypto Service Encryption User role on kv-zenix-secure to uami-zenix-storage.Answer
- CAssign the Key Vault Contributor role on kv-zenix-secure to uami-zenix-storage.
- DEnable the 'Allow trusted Microsoft services to bypass this firewall' setting on sazenixprod.
Answer
Associate the user-assigned managed identity with the storage account, and assign the Key Vault Crypto Service Encryption User role on the Key Vault to the user-assigned managed identity.
To successfully configure customer-managed keys for an Azure Storage account using a user-assigned managed identity and a Key Vault that uses Azure RBAC, you must first associate the user-assigned managed identity with the storage account. Second, you must grant the identity data-plane access to the Key Vault. The Key Vault Crypto Service Encryption User role is the specific role designed for storage account encryption operations as it permits wrapping and unwrapping key actions.
Step-by-Step Solution
Key Concept
Configuring Customer-Managed Keys (CMK) for Azure Storage using a user-assigned managed identity and an Azure RBAC-enabled Azure Key Vault.