Encrypting Azure resources with customer-managed keys

By default, FreeIPA and Cloudera Data Hub disks attached to Azure VMs and the PostgreSQL server instance used by the Cloudera Data Hub clusters are encrypted with server-side encryption (SSE) using Platform Managed Keys (PMK), but you can optionally configure SSE with Customer Managed Keys (CMK).

The CMK can be specified during environment registration and, if present, is used for encrypting FreeIPA and Cloudera Data Hub disks and PostgreSQL server instances.

The disks that are attached to the VMs of the FreeIPA and Cloudera Data Hub clusters will be associated with a Disk Encryption Set (DES) that is created with the key URL as the underlying encryption key version. The DES dedicated to the Cloudera environment will be created in the resource group of the environment before the FreeIPA launch at the beginning of the environment creation process.

When meeting Azure requirements for Cloudera, you must do the following:

Add additional permissions for Cloudera provisioning credentials.
Create a key vault and a vault key.
If you are using Azure Database for PostgreSQL Flexible Server with Cloudera, you can optionally use the CMK used for encrypting VM disks to encrypt the Azure Flexible Server database instance used by Cloudera. In this case, you should create a managed identity.

note

The CMK used for VM encryption can also be used for encrypting Azure Database for PostgreSQL Flexible Server used by Cloudera. This can be done through a user-supplied managed identity, as described in Configuring a CMK for data encryption in Azure Database for PostgreSQL Flexible Server and Managed identity for encrypting Azure Database for PostgreSQL Flexible Server. If the Flexible Server encryption with a CMK is set up, the permissions for accessing the CMK in Key Vault are conveyed by the user-supplied managed identity. In this case, the Key Vault resource may be configured with the "access policy" model or "RBAC" access control model. Cloudera will not make any changes to the Key Vault access policy; all permissions for accessing the Key Vault are encapsulated by the user-supplied managed identity. When using the "access policy" model, granting prior access for the user-supplied managed identity in the Key Vault access policy is your responsibility.

In other words, when you provide the managed identity for CMK, VM disk encryption (via the DES resource) works identical to Flexible Server encryption. If the user-supplied managed identity is not provided, the permissions for accessing the CMEK in Key Vault are conveyed using a system-assigned managed identity created by Cloudera. In this case, the Key Vault resource must be configured with the "access policy" model. Cloudera will automatically grant and revoke permissions for the DES system-assigned managed identity principal in the Key Vault resource access policy.

For more information about Azure Key Vault’s authorization systems, see Azure role-based access control (Azure RBAC) vs. access policies (legacy).