Azure Disk Encryption impact on Application Side

Question

Hello Team,

I would like to understand the impact of enabling Azure Disk Encryption at the application level. This is being enabled in existing VM's where applications are running, so would like to check whether application code changes are required for accessing the data in Data disk/OS disk using the keys in Keyvault.

Additionally, is it best practice to set expiration date for the automatic keys (wrapped BEK) in the Keyvault and what would be the impact if it is expired?

Thanks,

Dinesh

Answer 1

@Dinesh Kumar Palani Thanks for posting your query on Microsoft Q&A.

Application code changes are not required while accessing data in an Azure Disk Encryption enabled disk.
Here's a detailed comparison of various encryption options available for VMs - https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview#comparison

Should Key Vault keys have an expiration date?
Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. It is a recommended security practice to set expiration dates on cryptographic keys.

You can learn more about auto-rotation of encryption keys here - https://learn.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-key-vault?tabs=azure-portal#azure-disk-encryption-and-auto-rotation

Additional Reading:

• https://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy#lifecycle-of-keys
• https://learn.microsoft.com/en-us/azure/key-vault/policy-reference

I hope this helps.

---

If you have any questions at all, please let me know in the "comments" and I would be happy to help you. Comment is the fastest way of notifying the experts.

Please don’t forget to Accept Answer and hit Yes for "was this answer helpful" wherever the information provided helps you. This can be beneficial to other community members for remediation for similar issues.