Encryption Settings - Storage Account

[hashibot]

This issue was originally opened by @raghavanr as hashicorp/terraform#17022. It was migrated here as a result of the provider split. The original body of the issue is below.

---

how to encrypt VM and Storage Account with Microsoft.Keyvault rather than Microsoft.Storage using terraform.
getting the error when trying with the below code..
``
resource "azurerm_storage_account" "sa" {
name = "sa"
resource_group_name = "${azurerm_resource_group.myrg.name}"
location = "${azurerm_resource_group.myrg.location}"
account_tier = "Standard"
account_replication_type = "LRS"
enable_blob_encryption = "true"
enable_file_encryption = "true"
account_encryption_source = "Microsoft.Keyvault"
}

[scottambroseio]

Having done a little digging into this, I've managed to track down what I believe the issue is.

https://github.com/terraform-providers/terraform-provider-azurerm/blob/9733b43b2b0b439c5b46c3b68cd3e4c3f85e9e8e/azurerm/resource_arm_storage_account.go#L243-L249

doesn't set the required KeyVaultProperties as defined in

https://github.com/Azure/azure-sdk-for-go/blob/934e2462aeb6e0c14186dcfeedd73a026d1b8eeb/arm/storage/models.go#L402-L406

https://github.com/Azure/azure-sdk-for-go/blob/934e2462aeb6e0c14186dcfeedd73a026d1b8eeb/arm/storage/models.go#L444-L448

[bg2132332]

Hi, this was linked to issue #1323, which is now released, but I don't see KeyVaultProperties added. Is that something planned?

[LaurentLesle]

After reviewing the issue, looks like the "KeyVaultProperties" are missing.

this is what I have to do to setup storage encryption with Keyvault from ARM template:

"properties": {
"supportsHttpsTrafficOnly": true,
"encryption": {
"keyvaultproperties": {
"keyvaulturi": "https://kv242342.vault.azure.net",
"keyname": "storage-key-rsa-hsm-2048",
"keyversion": "fad0fdc1011a43108ada5ed51995ccdd"
},
"services": {
"file": {
"enabled": true
},
"blob": {
"enabled": true
}
},
"keySource": "Microsoft.Keyvault"
}
}

[jlucktay]

@LaurentLesle we're hitting an error in Terraform v0.11.10 and provider.azurerm v1.19.0 with the same template layout to yours:
FeatureNotSupportedForAccount - EncryptionAtRest/Customer Managed Key is not supported for the account.
We have sku.name in the template set to Premium_LRS if relevant.

When sending the same JSON through Azure CLI, we get:
The accountType field is missing from the request.
According to this template accountType is an old name for the sku.name field.

[steffencircle]

Hi,

can somebody give me some more insights on this ?
I am trying to deploy a Storage Account with Custom Encryption settings.
Ideally it should point to a Key in a KeyVault that I also deployed.

Looking at the specs of storage_account resource, it seems I can specify a KeyVault as a Source, but not which KeyVault and which Key etc....

Am I missing something here ? What's the point of being able to specify the Source but not to be able to provide further settings ?

Has anybody found a workaround for this ?

Thx in advance

[sean-bailey]

Hi,

can somebody give me some more insights on this ?
I am trying to deploy a Storage Account with Custom Encryption settings.
Ideally it should point to a Key in a KeyVault that I also deployed.

Looking at the specs of storage_account resource, it seems I can specify a KeyVault as a Source, but not which KeyVault and which Key etc....

Am I missing something here ? What's the point of being able to specify the Source but not to be able to provide further settings ?

Has anybody found a workaround for this ?

Thx in advance

Seconding this. Looking at the documentation, it does appear we can specify Microsoft.KeyVault as a source of our encryption, but it is not clear at all as to which Keyvault/Key/etc is to be specified. Looking above, we can't specify the KeyVault properties. Is there a proper method we should be using with Terraform if we specify KeyVault as our encryption source?

[KevinBrooke]

The Key vault must have purge protection + soft delete enabled which is not supported by TF as they cannot be disabled, meaning the resource lifecycle cannot be managed. A workaround is to use a null_resource to enable these settings (e.g. with azure cli).

Once that is done, assign an MSI to the storage account, permission the MSI to the Key Vault and use another null_resource to execute the commands to enable key vault encryption (I use azure cli).

[viswanathareddy04]

I have taken an another approach with the local-exec provision, created a powershell script and executed that script file using terraform.

[ghost]

This has been released in version 2.0.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.0.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!