Share via

Key auto-rotation not compatible with Azure Disk Encryption

Anonymous
2023-01-06T08:28:59.417+00:00

Hi all,

on
https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault?tabs=azure-portal#azure-disk-encryption-and-auto-rotation
it is said that:
Although Azure Key Vault now has key auto-rotation, it isn't currently compatible with Azure Disk Encryption. Specifically, Azure Disk Encryption will continue to use the original encryption key, even after it has been auto-rotated.

If we create a Key Encryption Key (KEK) for an additional layer of security for Azure Disk Encryption (ADE) and enable auto-rotation for this KEK, will the new version of this KEK after auto rotation automatically be used for wrapping the current ADE Bitlocker Encryptions keys (BEK)?

kind regards
Nick

276690-ms-wrappedbek.png

Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andriy Bilous 10,996 Reputation points MVP
    2023-01-09T16:27:36.95+00:00

    Hello @Anonymous

    You can rotate the KEK by calling the command above 

    az vm encryption enable -n vmname -g rsgrp --key-encryption-key kek --disk-encryption-keyvault keyvault-name --volume-type ALL --encrypt-format-all

    every time when you need a newer version of the KEK.
    Doing so, secret of type Wrapped BEKs in addition to existing one is added for VM.

    https://learn.microsoft.com/en-us/answers/questions/763816/rotating-ade-kek-adds-two-new-secrets-wrapped-beks.html
    https://github.com/MicrosoftDocs/azure-docs/issues/40707

    0 comments