Add CMK support for core resources #4149
Conversation
…02-cmk-support
…02-cmk-support
Unit Test Results0 tests 0 ✅ 0s ⏱️ Results for commit c05f752. ♻️ This comment has been updated with latest results. |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/11916800932 (with refid (in response to this comment from @yuvalyaron) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/11923480499 (with refid (in response to this comment from @yuvalyaron) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/11923684873 (with refid (in response to this comment from @yuvalyaron) |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/11923684873 (with refid (in response to this comment from @yuvalyaron) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/11930799088 (with refid (in response to this comment from @yuvalyaron) |
| key_type = "RSA" | ||
| key_size = 2048 | ||
|
|
||
| key_opts = [ |
There was a problem hiding this comment.
nit: if the key is not used only for encryption / decryption, consider naming the module not cmk_encyption but more generic name
Resolves #4142, #4143
What is being addressed
Added CMK support for Storage accounts and VM storage disks for core TRE resources.
Added the option to use an external Key Vault to store the CMKs
Important: Note that there is still work to be done for completing #4002
How is this addressed
users set
enable_cmk_encryption: truein theconfig.yaml,and either
encryption_kv_nameorexternal_key_store_idfor the key vault.