使用存储在 Azure Key Vault 中的客户管理的密钥配置加密Configure encryption with customer-managed keys stored in Azure Key Vault

Azure 存储对静态存储帐户中的所有数据进行加密。Azure Storage encrypts all data in a storage account at rest. 默认情况下,数据使用 Microsoft 管理的密钥进行加密。By default, data is encrypted with Microsoft-managed keys. 为了更进一步控制加密密钥,你可以管理自己的密钥。For additional control over encryption keys, you can manage your own keys. 客户管理的密钥必须存储在 Azure Key Vault 中。Customer-managed keys must be stored in Azure Key Vault.

本文介绍了如何使用 Azure 门户、PowerShell 或 Azure CLI,通过存储在密钥保管库中的客户管理的密钥配置加密。This article shows how to configure encryption with customer-managed keys stored in a key vault by using the Azure portal, PowerShell, or Azure CLI.

配置密钥保管库Configure a key vault

你可以使用新的或现有的密钥保管库来存储客户管理的密钥。You can use a new or existing key vault to store customer-managed keys. 存储帐户和 Key Vault 必须在同一个区域中,但可以在不同的订阅中。The storage account and the key vault must be in the same region, but they can be in different subscriptions.

使用带有 Azure 存储加密的客户管理的密钥需要为密钥保管库启用软删除和清除保护。Using customer-managed keys with Azure Storage encryption requires that both soft delete and purge protection be enabled for the key vault. 创建新密钥保管库时,默认会启用软删除,并且无法禁用。Soft delete is enabled by default when you create a new key vault and cannot be disabled. 你可以在创建密钥保管库时或创建后启用清除保护。You can enable purge protection either when you create the key vault or after it is created.

若要了解如何使用 Azure 门户创建密钥保管库,请参阅快速入门:使用 Azure 门户创建密钥保管库To learn how to create a key vault with the Azure portal, see Quickstart: Create a key vault using the Azure portal. 创建密钥保管库时,选择“启用清除保护”,如下图所示。When you create the key vault, select Enable purge protection, as shown in the following image.

显示如何在创建密钥保管库时启用清除保护的屏幕截图

若要在现有密钥保管库上启用清除保护,请执行以下步骤:To enable purge protection on an existing key vault, follow these steps:

  1. 在 Azure 门户中导航到密钥保管库。Navigate to your key vault in the Azure portal.
  2. 在“设置”下面,选择“属性”。Under Settings, choose Properties.
  3. 在“清除保护”部分,选择“启用清除保护” 。In the Purge protection section, choose Enable purge protection.

添加密钥Add a key

接下来,在密钥保管库中添加密钥。Next, add a key in the key vault.

Azure 存储加密支持 2048、3072 和 4096 大小的 RSA 密钥。Azure Storage encryption supports RSA keys of sizes 2048, 3072 and 4096. 有关密钥的详细信息,请参阅关于密钥For more information about keys, see About keys.

若要了解如何使用 Azure 门户添加密钥,请参阅快速入门:使用 Azure 门户在 Azure Key Vault 中设置和检索密钥中的说明创建密钥保管库。To learn how to add a key with the Azure portal, see Quickstart: Set and retrieve a key from Azure Key Vault using the Azure portal.

配置使用客户管理的密钥进行加密Configure encryption with customer-managed keys

接下来,请将 Azure 存储帐户配置为通过 Azure Key Vault 使用客户管理的密钥,然后指定要与存储帐户关联的密钥。Next, configure your Azure Storage account to use customer-managed keys with Azure Key Vault, then specify the key to associate with the storage account.

使用客户管理的密钥配置加密时,只要关联的密钥保管库中有新版本可用,就可以选择自动更新用于 Azure 存储加密的密钥版本。When you configure encryption with customer-managed keys, you can choose to automatically update the key version used for Azure Storage encryption whenever a new version is available in the associated key vault. 也可显式指定在手动更新密钥版本之前用于加密的密钥版本。Alternately, you can explicitly specify a key version to be used for encryption until the key version is manually updated.

备注

若要轮换密钥,请在 Azure Key Vault 中创建密钥的新版本。To rotate a key, create a new version of the key in Azure Key Vault. Azure 存储不会处理 Azure Key Vault 中的密钥轮换,因此你需要手动轮换密钥,或创建一个函数以便按计划轮换密钥。Azure Storage does not handle the rotation of the key in Azure Key Vault, so you will need to rotate your key manually or create a function to rotate it on a schedule.

配置加密以自动更新密钥版本Configure encryption for automatic updating of key versions

Azure 存储可以自动更新客户管理的密钥(用于加密),以使用最新密钥版本。Azure Storage can automatically update the customer-managed key that is used for encryption to use the latest key version. 当在 Azure Key Vault 中轮换客户管理的密钥时,Azure 存储会自动开始将最新版本的密钥用于加密。When the customer-managed key is rotated in Azure Key Vault, Azure Storage will automatically begin using the latest version of the key for encryption.

若要在 Azure 门户中配置客户管理的密钥并自动更新密钥版本,请执行以下步骤:To configure customer-managed keys with automatic updating of the key version in the Azure portal, follow these steps:

  1. 导航到存储帐户。Navigate to your storage account.

  2. 在存储帐户的“设置”边栏选项卡上,单击“加密”。On the Settings blade for the storage account, click Encryption. 默认情况下,密钥管理设置为“Microsoft 管理的密钥”,如下图所示。By default, key management is set to Microsoft Managed Keys, as shown in the following image.

    显示加密选项的门户屏幕截图

  3. 选择“客户管理的密钥”选项。Select the Customer Managed Keys option.

  4. 选择“从 Key Vault 中选择”选项。Choose the Select from Key Vault option.

  5. 选择“选择密钥保管库和密钥”。Select Select a key vault and key.

  6. 选择包含要使用的密钥的密钥保管库。Select the key vault containing the key you want to use.

  7. 从密钥保管库中选择密钥。Select the key from the key vault.

    屏幕截图,显示如何选择密钥保管库和密钥

  8. 保存所做更改。Save your changes.

指定密钥后,Azure 门户会指示启用密钥版本的自动更新,并显示当前用于加密的密钥版本。After you've specified the key, the Azure portal indicates that automatic updating of the key version is enabled and displays the key version currently in use for encryption.

屏幕截图,其中显示已启用自动更新密钥版本

为手动更新密钥版本配置加密Configure encryption for manual updating of key versions

如果希望手动更新密钥版本,请在使用客户管理的密钥配置加密时显式指定该版本。If you prefer to manually update the key version, then explicitly specify the version at the time that you configure encryption with customer-managed keys. 在这种情况下,当在密钥库中创建新版本时,Azure 存储将不会自动更新密钥版本。若要使用新的密钥版本,必须手动更新用于 Azure 存储加密的版本。In this case, Azure Storage will not automatically update the key version when a new version is created in the key vault.To use a new key version, you must manually update the version used for Azure Storage encryption.

若要在 Azure 门户中配置客户管理的密钥并手动更新密钥版本,请指定密钥 URI,包括版本。To configure customer-managed keys with manual updating of the key version in the Azure portal, specify the key URI, including the version. 若要将某个密钥指定为 URI,请执行下列步骤:To specify a key as a URI, follow these steps:

  1. 若要在 Azure 门户中查找密钥 URI,请导航到 Key Vault,然后选择“密钥”设置。To locate the key URI in the Azure portal, navigate to your key vault, and select the Keys setting. 选择所需的密钥,然后单击该密钥以查看其版本。Select the desired key, then click the key to view its versions. 选择一个密钥版本,查看该版本的设置。Select a key version to view the settings for that version.

  2. 复制“密钥标识符”字段的值(提供 URI)。Copy the value of the Key Identifier field, which provides the URI.

    显示 Key Vault 密钥 URI 的屏幕截图

  3. 在存储帐户的“加密密钥”设置中,选择“输入密钥 URI”选项。 In the Encryption key settings for your storage account, choose the Enter key URI option.

  4. 将复制的 URI 粘贴到“密钥 URI”字段中。Paste the URI that you copied into the Key URI field. 从 URI 中省略密钥版本,以启用自动更新密钥版本。Omit the key version from the URI to enable automatic updating of the key version.

    显示如何输入密钥 URI 的屏幕截图

  5. 指定包含密钥保管库的订阅。Specify the subscription that contains the key vault.

  6. 保存所做更改。Save your changes.

更改密钥Change the key

你可以在任何时候更改用于 Azure 存储加密的密钥。You can change the key that you are using for Azure Storage encryption at any time.

若要使用 Azure 门户更改密钥,请执行以下步骤:To change the key with the Azure portal, follow these steps:

  1. 导航到你的存储帐户,并显示“加密”设置。Navigate to your storage account and display the Encryption settings.
  2. 选择密钥保管库并选择一个新密钥。Select the key vault and choose a new key.
  3. 保存更改。Save your changes.

撤销客户托管密钥Revoke customer-managed keys

撤消客户管理的密钥会删除存储帐户和密钥保管库之间的关联。Revoking a customer-managed key removes the association between the storage account and the key vault.

若要使用 Azure 门户撤消客户管理的密钥,请按照禁用客户管理的密钥中所述禁用该密钥。To revoke customer-managed keys with the Azure portal, disable the key as described in Disable customer-managed keys.

禁用客户托管密钥Disable customer-managed keys

禁用客户托管密钥时,将再次使用 Microsoft 托管密钥对存储帐户进行加密。When you disable customer-managed keys, your storage account is once again encrypted with Microsoft-managed keys.

若要在 Azure 门户中禁用客户管理的密钥,请执行以下步骤:To disable customer-managed keys in the Azure portal, follow these steps:

  1. 导航到你的存储帐户,并显示“加密”设置。Navigate to your storage account and display the Encryption settings.
  2. 取消选中“使用自己的密钥”设置旁边的复选框。Deselect the checkbox next to the Use your own key setting.

后续步骤Next steps