Skip to content

Customer Managed Keys

Customer Managed Keys (CMK) allow you to control the encryption of your data by providing your own cryptographic keys. This feature enables you to meet compliance requirements and maintain ownership over your data security.

Key Concepts

  • Encryption at Rest: Data is encrypted using keys that you manage, ensuring that only authorized users and services can access the data.
  • Key Rotation: You can rotate your keys periodically to enhance security and meet regulatory standards.
  • Key Revocation: If a key is compromised, you can revoke access, immediately preventing further use.

How Customer Managed Keys Work

Customer Managed Keys are stored in a secure key vault, such as Azure Key Vault. The service retrieves the key from the vault to encrypt and decrypt data as needed. You retain full control over the lifecycle of your keys, including creation, rotation, and deletion.

Benefits

  • Compliance: Meet industry and regulatory requirements for data protection.
  • Control: Maintain ownership and control over your encryption keys.
  • Security: Enhance data security by managing key access and rotation policies.

Prerequisites

You must have an active subscription to a supported cloud provider. You need permissions to create and manage keys in the key vault. The service must be configured to use customer managed keys for encryption.

Implementation Steps

  1. Create a key in your key vault.
  2. Grant the necessary permissions to the service.
  3. Configure the service to use your customer managed key for encryption.
  4. Monitor and rotate keys as required.

Best Practices

  • Regularly rotate your keys to minimize risk.
  • Monitor key usage and access logs.
  • Restrict key management permissions to trusted administrators.

Resources

For more information, refer to your cloud provider's documentation on customer managed keys.