diff --git a/en/azure/storageaccounts/log-storage-encryption.md b/en/azure/storageaccounts/log-storage-encryption.md index 7ef502b9c..23436e3af 100644 --- a/en/azure/storageaccounts/log-storage-encryption.md +++ b/en/azure/storageaccounts/log-storage-encryption.md @@ -16,19 +16,17 @@ ## Detailed Remediation Steps -1. Log into the Microsoft Azure Management Console. -2. Select the "Search resources, services, and docs" option at the top and search for Monitor.
-3. Select the "Log Activity" on the "Monitor-Overview" page.
-4. On the "Activity Log" page, click on the "Diagnostics Settigns" at the top.
-5. On the "Diagnostics settings" page, copy the "Storage account" name for the "Activity Log".
-6. Select the "Search resources, services, and docs" option at the top and search for "Storage account."
+1. Log in to the Microsoft Azure Management Console. +2. Select the "Search resources, services, and docs" option at the top and search for "Monitor".
+3. On the left navigation panel, click on "Diagnostics Settigns" under "Settings".
+4. On the "Diagnostics settings" page, select the resource from the list with value "Enabled" in the "Diagnostic status" column by clicking on its name.
+5. On the resource configuration page, copy the "Storage account" name for the "Activity Log".
+6. Now select the "Search resources, services, and docs" option at the top and search for "Storage accounts".
7. Paste the "Storage account" name on the "Filter" option at the top, copied in Step 5 and select the corresponding "Storage account."
-8. Scroll down the "Storage account" navigation panel and choose "Encryption" option under the "Settings."
-9. On the "Encryption page" scroll down and check "Use your own key" setting configuration. If "Use your own key" setting checkbox is not checked, then "BYOK encryption" is not configured in the Activity Log Storage Account.
-10. Repeat steps number 2 - 9 to verify other "Log Storage Encryptions" in the Azure account.
-11. Navigate to "Storage account", select the corresponding "Storage account", scroll down the left navigation panel and choose "Encryption."
-12. On the "Encyption page" select the "Use your own key" and click on the "Select from Key Vault".
-13. On the "Key vault" option select the vault accordingly.
-14. On the "Encryption key" option select the key accordingly.
-15. Click on the "Save" option at the top to make the changes.
-16. Repeat steps number 11 - 15 to ensure the Storage Account used by Activity Logs is configured with a BYOK key.
+8. Scroll down the "Storage account" navigation panel and select "Encryption" under "Security + networking."
+9. On the "Encryption page" scroll down and check the "Encryption type". If "Microsoft-managed keys" is selected, then "BYOK encryption" is not configured in the Activity log storage account.
+10. To enable "BYOK encryption" select "Encryption type" as "Customer-managed keys". In the "Encryption key" select option "Select from key vault".
+11. In the "Key Vault and key" click on the blue hughlighted text "Select a key vault and key".
+12. On the "Select a key" page, select "Key store type" as "Key vault". In the "Key vault" and "key" options select the key vault and key from the dropdown or you can create your own key vault and key. Click "Select" button at the end to save the selected options.
+13. Click on the "Save" button at the end to make the changes.
+14. Repeat step number 4 - 13 to ensure the Storage Account used by Activity Logs is configured with a BYOK key for all resources with Diagnostic Status "Enabled".
diff --git a/resources/azure/storageaccounts/log-storage-encryption/step10.png b/resources/azure/storageaccounts/log-storage-encryption/step10.png new file mode 100644 index 000000000..766ef5160 Binary files /dev/null and b/resources/azure/storageaccounts/log-storage-encryption/step10.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step11.png b/resources/azure/storageaccounts/log-storage-encryption/step11.png index 7021aa762..554fbd5bd 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step11.png and b/resources/azure/storageaccounts/log-storage-encryption/step11.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step12.png b/resources/azure/storageaccounts/log-storage-encryption/step12.png index 6ff1b0364..ed0645f43 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step12.png and b/resources/azure/storageaccounts/log-storage-encryption/step12.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step13.png b/resources/azure/storageaccounts/log-storage-encryption/step13.png index e3921d0c2..b2d7a8673 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step13.png and b/resources/azure/storageaccounts/log-storage-encryption/step13.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step14.png b/resources/azure/storageaccounts/log-storage-encryption/step14.png deleted file mode 100644 index 500083a34..000000000 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step14.png and /dev/null differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step15.png b/resources/azure/storageaccounts/log-storage-encryption/step15.png deleted file mode 100644 index 2c92bad70..000000000 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step15.png and /dev/null differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step2.png b/resources/azure/storageaccounts/log-storage-encryption/step2.png index c56518adb..729f236d7 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step2.png and b/resources/azure/storageaccounts/log-storage-encryption/step2.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step3.png b/resources/azure/storageaccounts/log-storage-encryption/step3.png index 3f69c1149..928c2f6ec 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step3.png and b/resources/azure/storageaccounts/log-storage-encryption/step3.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step4.png b/resources/azure/storageaccounts/log-storage-encryption/step4.png index fdf0a1330..d0677702d 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step4.png and b/resources/azure/storageaccounts/log-storage-encryption/step4.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step5.png b/resources/azure/storageaccounts/log-storage-encryption/step5.png index 3a89f137a..b2660dd99 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step5.png and b/resources/azure/storageaccounts/log-storage-encryption/step5.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step6.png b/resources/azure/storageaccounts/log-storage-encryption/step6.png index fbfebb3b2..a0cd8a7e4 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step6.png and b/resources/azure/storageaccounts/log-storage-encryption/step6.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step7.png b/resources/azure/storageaccounts/log-storage-encryption/step7.png index 4ac76e636..65eaeb4c0 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step7.png and b/resources/azure/storageaccounts/log-storage-encryption/step7.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step8.png b/resources/azure/storageaccounts/log-storage-encryption/step8.png index e9455e633..b83d94238 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step8.png and b/resources/azure/storageaccounts/log-storage-encryption/step8.png differ diff --git a/resources/azure/storageaccounts/log-storage-encryption/step9.png b/resources/azure/storageaccounts/log-storage-encryption/step9.png index c75653f64..662b1d742 100644 Binary files a/resources/azure/storageaccounts/log-storage-encryption/step9.png and b/resources/azure/storageaccounts/log-storage-encryption/step9.png differ