Customer-Managed Keys
← Back to DP-420 Terminology Reference
Category: Maintenance & Security
Summary: Encrypt data at rest using a key you control in Azure Key Vault.
Overview
Customer-managed keys (CMK) allow you to encrypt Azure Cosmos DB data at rest using an encryption key that you control and manage in Azure Key Vault, rather than relying solely on Microsoft's platform-managed keys. This gives organizations control over key rotation, revocation, and compliance requirements, at the cost of additional operational responsibility for key management.
- Step 1: Prepare the Azure Key Vault Create or select an Azure Key Vault. You must ensure three specific settings are configured on the vault:
- Soft Delete and Purge Protection must be enabled (required by Cosmos DB to prevent accidental key loss).
- Permission model must be set to Azure role-based access control (RBAC) (required to grant permissions to a specific key rather than the whole vault).
- Step 2: Generate the Key and Assign Granular Permissions Inside your Key Vault, generate the encryption key and immediately lock down who can use it:
- Generate a new key (an RSA key size of 3072 or higher is recommended).
- Once generated, select that specific key, click on its Access control (IAM) menu, and add a role assignment.
- Assign the Key Vault Crypto Service Encryption User role to the Azure Cosmos DB principal.
- Before leaving the screen, copy the key's Key Identifier (URI).
- Step 3: Create the Azure Cosmos DB Account During the creation of your new Azure Cosmos DB account in the Azure portal, navigate to the Encryption tab. Select Customer-managed key and paste the Key URI you copied in Step 2. Cosmos DB will validate its access to that specific key and encrypt the new account.
More Info & Links
DP-420 Style Practice Questions
Q1. What is the main advantage of using customer-managed keys (CMK) over platform-managed keys?
- A. Full control over encryption key management, rotation, and revocation via Azure Key Vault
- B. Lower cost than platform-managed keys
- C. Elimination of the need to configure network access control
- D. Automatic multi-region writes
Q2. Where are customer-managed keys typically stored and managed for Azure Cosmos DB?
- A. Azure Key Vault
- B. Inside the Cosmos DB container itself
- C. In the application's source code
- D. In Azure Active Directory Connect
Answer Key
Answers are listed at the very end so you can attempt the questions first.
- Q1 (Customer-Managed Keys): A. Full control over encryption key management, rotation, and revocation via Azure Key Vault — CMK gives the customer control over key lifecycle management, useful for meeting specific compliance requirements.
- Q2 (Customer-Managed Keys): A. Azure Key Vault — Customer-managed keys are stored and managed in Azure Key Vault, which Azure Cosmos DB references for encryption operations.
DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page
