无法通过 ARM 模板将 CMK 加密应用于 Azure 存储帐户

Question

我正在尝试通过 ARM 模板将 CMK 加密附加到 Azure 存储帐户，但出现如下错误。需要快速帮助。创建存储帐户后可以通过门户应用它，但无法在创建存储帐户时通过 ARM 模板进行应用。

错误 - [error]FeatureNotSupportedForAccount：缺少启用此存储帐户的 EncryptionAtRest/Customer 托管密钥的先决条件。

手臂：-

"resources": [
{
  "type": "Microsoft.Storage/storageAccounts",
  "apiVersion": "2019-04-01",
  "name": "[variables('storageaccountname')]",
  "location": "[resourceGroup().location]",
  "sku": {
    "name": "[parameters('storageaccountype')]"
  },
  "kind": "[parameters('storagekind')]",
  "properties": {
    "supportsHttpsTrafficOnly": true,
    "accesstier": "[parameters('accesstier')]",
    "largeFileSharesState": "[parameters('largefilesharesstate')]",
    "allowBlobPublicAccess": false,
    "encryption": {
      "services": {
        "file": {
          "enabled": true
        },
        "blob": {
          "enabled": true
        }
      },
      "keySource": "Microsoft.Keyvault",
      "keyvaultproperties": {
        "keyvaulturi": "[parameters('kvuri')]",
        "keyname": "[parameters('keyname')]",
        "keyversion": "[parameters('keyversion')]"
      }
    }
  },
  "tags": {
    "abcid": "[parameters('abcid')]"
  }
}

Answer 1

根据document，如果要使用存储在 Azure key valt 中的客户管理密钥配置加密，我们需要执行以下步骤

创建存储帐户并启用身份
更新 Azure 密钥保管库。启用软删除和清除保护。
为存储帐户的身份配置访问策略
为存储帐户配置客户管理的密钥。

关于如何用arm模板配置这些，请参考下面的模板

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "keyName": {
            "type": "string",
            "defaultValue": ""
        },
        "keyVersion": {
            "type": "string",
            "defaultValue": ""
        },
        "vaultName": {
            "defaultValue": "",
            "type": "String"
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]"
        },
        "accountNmae": {
            "type": "string",
            "defaultValue": "tetsdfgfgdffd"
        },
    },
    "variables": {},
    "resources": [{
            "type": "Microsoft.Storage/storageAccounts",
            "sku": {
                "name": "Standard_LRS",
                "tier": "Standard"
            },
            "kind": "Storage",
            "name": "[ parameters('accountNmae')]",
            "apiVersion": "2019-06-01",
            "location": "[ parameters('location')]",
            "identity": {
                "type": "SystemAssigned"
            },
            "properties": {
                "supportsHttpsTrafficOnly": true
            },
            "dependsOn": []
        }, {
            "type": "Microsoft.KeyVault/vaults",
            "apiVersion": "2016-10-01",
            "name": "[parameters('vaultName')]",
            "location": "eastasia",
            "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('accountNmae'))]"
            ],
            "properties": {
                "sku": {
                    "family": "A",
                    "name": "Standard"
                },
                "tenantId": "[subscription().tenantid]",
                "accessPolicies": [],
                "enabledForDeployment": true,
                "enabledForDiskEncryption": true,
                "enabledForTemplateDeployment": true,
                "enableSoftDelete": true
            }
        }, {

            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2019-07-01",
            "name": "updateStorageAccount",
            "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', parameters('vaultName'))]"
            ],
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "0.1.0.0",
                    "resources": [{
                            "type": "Microsoft.KeyVault/vaults/accessPolicies",
                            "name": "[concat(parameters('vaultName'), '/add')]",
                            "apiVersion": "2019-09-01",
                            "properties": {
                                "accessPolicies": [{
                                        "tenantId": "[subscription().tenantid]",
                                        "objectId": "[reference(resourceId('Microsoft.Storage/storageAccounts',  parameters('accountNmae')),'2019-06-01', 'full').identity.principalId]",
                                        "permissions": {
                                            "keys": [
                                                "wrapkey",
                                                "unwrapkey",
                                                "get"
                                            ],
                                            "secrets": [],
                                            "certificates": []
                                        }
                                    }
                                ]
                            }
                        }, {
                            "type": "Microsoft.Storage/storageAccounts",
                            "sku": {
                                "name": "Standard_LRS",
                                "tier": "Standard"
                            },
                            "kind": "Storage",
                            "name": "[parameters('accountNmae')]",
                            "apiVersion": "2019-06-01",
                            "location": "[parameters('location')]",
                            "identity": {
                                "type": "SystemAssigned"
                            },
                            "properties": {
                                "encryption": {
                                    "services": {
                                        "file": {
                                            "enabled": true
                                        },
                                        "blob": {
                                            "enabled": true
                                        }
                                    },
                                    "keySource": "Microsoft.Keyvault",
                                    "keyvaultproperties": {
                                        "keyvaulturi": "[reference(resourceId('Microsoft.KeyVault/vaults',parameters('vaultName')),'2016-10-01', 'full').properties.vaultUri]",
                                        "keyname": "[parameters('keyName')]",
                                        "keyversion": "[parameters('keyversion')]"
                                    }
                                }
                            },
                            "dependsOn": [
                                "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('vaultName'), 'add')]"
                            ]
                        }
                    ]
                }
            }
        }
    ]
}

详情请参考blog

无法通过 ARM 模板将 CMK 加密应用于 Azure 存储帐户

Not able to apply CMK encryption to Azure Storage Account through ARM Template

encryption

azure-storage

arm-template

azure-files

azure-storage-account