Feature: Storage Account Creation with Encryption using Customer Managed Keys

[ravichaudhary11]

I am trying to create storage account that uses customer-managed keys for encryption. Azure-Service Operator V2.7.0.

apiVersion: storage.azure.com/v1api20230101
kind: StorageAccount
metadata:
  name: standardcmk
  namespace: test
spec:
  azureName: clusterstandardcmk
  originalVersion: v1api20230101
  accessTier: Hot
  publicNetworkAccess: Disabled
  allowBlobPublicAccess: false
  location: westeurope
  kind: StorageV2
  sku:
   name: Standard_LRS
  owner:
    armId: /subscriptions/SUB_ID/resourceGroups/my-rg
  identity:
    type: UserAssigned
    principalId: Prinicpal_ID
    tenandId: Tenand-ID
    userAssignedIdentity: /subscriptions/SUB-ID/resourcegroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/tst-identity
  encryption:
    keySource: Microsoft.Keyvault
    keyvaultproperties:
      keyvaulturi: https://vault_url
      keyname: ts-key-cmk
      keyversion: 9f56363yfhioh947990
    services:
      blob:
        keyType: Account
        enabled: true

EXPECTED Behaviour Account should get created with CMK

Error Missing pre-requisites to enable EncryptionAtRest/Customer Managed Key for this storage account. For more information, see - https://aka.ms/storagecmkconfiguration

RESPONSE 409: 409 Conflict ERROR CODE: FeatureNotSupportedForAccount

[matthchr]

Using customer-managed keys with Azure Storage encryption requires that both soft delete and purge protection be enabled for the key vault.

From the referenced aka.ms link, does your KeyVault have the correct configuration as per the requirements from storage?

[ravichaudhary11]

Yes Both settings are enabled.