Creating a new vault and vault key

Create a vault and vault key on your Azure portal.

Create a key vault in the same region and resource group as the one that you want to use for registering the Cloudera environment.

Go to Key vaults in the Azure Portal.
Click +New or Create key vault.
When providing key vault parameters, ensure that:
- The Region matches the target region of the Cloudera environment. Storage accounts can be in different resource groups than the key vault, provided the location/region is the same.
- Purge protection is enabled.
- Provide other parameters based on your organization's requirements. For instructions, see Create a vault in the Azure documentation.
Click Create.
Generate or import a key in the previously created key vault.
Ensure that it is an RSA key with a size of 2048, 3072, or 4096 bits.
Select Keys.
Click Generate/Import.

Figure 1. Generate/Import new vault key
Provide the key name and key type (make sure to select RSA).
For detailed instructions, see Add a key to Key Vault in the Azure documentation.
Figure 2. Enter key name and key type
Go to the vault key details and copy the key identifier (an HTTPS URL) for the key that was created.
You will need to provide it during Cloudera environment registration later.
Figure 3. Copy key identifier
If you need encryption on the Azure storage account, you can set it up in the Encryption section of your storage account settings page on the Azure portal using the same or a different encryption key.

note
The key used for Azure storage encryption can be the same or different from the key vault used for disk encryption. The storage account can be in a different resource group, but should be in the same location/region and subscription as the key vault.

Figure 4. Set up Azure storage account encryption