{"id":1088,"date":"2020-05-19T13:00:42","date_gmt":"2020-05-19T20:00:42","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/cosmosdb\/?p=1088"},"modified":"2020-05-18T16:53:19","modified_gmt":"2020-05-18T23:53:19","slug":"customer-managed-keys-encryption","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cosmosdb\/customer-managed-keys-encryption\/","title":{"rendered":"Enhanced encryption at rest with customer-managed keys"},"content":{"rendered":"<p>Today, we are excited to announce the general availability of <a href=\"https:\/\/docs.microsoft.com\/azure\/cosmos-db\/how-to-setup-cmk\">encryption at rest with customer-managed keys<\/a> on <a href=\"http:\/\/www.AzureCosmosDB.com\">Azure Cosmos DB<\/a>. This new capability enhances our enterprise-grade security and compliance offering.<\/p>\n<p>Businesses often move their applications to the cloud for increased agility, elasticity and cost-effectiveness. But as they transition to managed platforms, they also need to maintain their expectations in terms of core security. In many industries, regulations and compliance obligations require the use of databases that not only encrypt data at rest, but do so by using<strong> encryption keys that end-users can control<\/strong>. While encryption at rest has been a default feature on Azure Cosmos DB for many years now, it is performed with service-managed keys, automatically and transparently managed by Microsoft. Customer-managed keys don&#8217;t disable this default encryption. Instead, they add a <strong>second layer of encryption<\/strong> on top of the default one.<\/p>\n<p><img decoding=\"async\" class=\"alignnone size-medium wp-image-1089 aligncenter\" src=\"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-content\/uploads\/sites\/52\/2020\/05\/cmk-intro-300x139.png\" alt=\"Layers of encryption around customer data\" width=\"300\" height=\"139\" srcset=\"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-content\/uploads\/sites\/52\/2020\/05\/cmk-intro-300x139.png 300w, https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-content\/uploads\/sites\/52\/2020\/05\/cmk-intro.png 500w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<p>This means that customer-managed keys also deliver <strong>double encryption<\/strong>, a feature that is sometimes part of the same compliance requirements.<\/p>\n<h4>Using Azure Key Vault as the key store<\/h4>\n<p>Customer-managed keys must be generated or imported in <a href=\"https:\/\/docs.microsoft.com\/azure\/key-vault\/general\/overview\">Azure Key Vault<\/a>, a secure storage service for keys, secrets and certificates. Azure Key Vault streamlines key management and gives you full control to manage and audit key access.<\/p>\n<h4>Creating a new Azure Cosmos DB account with customer-managed keys<\/h4>\n<p>Simply provide the key&#8217;s URI from Azure Key Vault when creating a new Azure Cosmos DB account. This can be done from the Azure Portal, or programmatically using Azure Resource Manager templates, PowerShell or the Azure CLI.<\/p>\n<p style=\"text-align: center;\"><img decoding=\"async\" class=\"alignnone wp-image-1090\" src=\"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-content\/uploads\/sites\/52\/2020\/05\/portal-cosmos-enc.png\" alt=\"Setting CMK parameters in the Azure portal\" width=\"600\" height=\"248\" srcset=\"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-content\/uploads\/sites\/52\/2020\/05\/portal-cosmos-enc.png 766w, https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-content\/uploads\/sites\/52\/2020\/05\/portal-cosmos-enc-300x124.png 300w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/p>\n<h4>Get started<\/h4>\n<ul>\n<li>Head to <a href=\"https:\/\/docs.microsoft.com\/azure\/cosmos-db\/how-to-setup-cmk\">our documentation<\/a> for details about encryption-at-rest with customer-managed keys today<\/li>\n<li>Read about <a href=\"https:\/\/devblogs.microsoft.com\/cosmosdb\/\">our other announcements<\/a> from Microsoft Build 2020<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Azure Cosmos DB enhances its enterprise-grade security offering. Encryption at rest with customer-managed keys is now generally available, adding a second layer of encryption on top of the default service-managed keys.<\/p>\n","protected":false},"author":13778,"featured_media":1089,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[12,667],"tags":[1141,1140,1139,1121],"class_list":["post-1088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-announcements","category-security","tag-byok","tag-cmk","tag-encryption","tag-msbuild"],"acf":[],"blog_post_summary":"<p>Azure Cosmos DB enhances its enterprise-grade security offering. Encryption at rest with customer-managed keys is now generally available, adding a second layer of encryption on top of the default service-managed keys.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/posts\/1088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/users\/13778"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/comments?post=1088"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/posts\/1088\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/media\/1089"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/media?parent=1088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/categories?post=1088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cosmosdb\/wp-json\/wp\/v2\/tags?post=1088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}