简体繁体 English

Azure磁盘加密Linux VM密钥轮换

[英]Azure Disk Encryption Linux VM key rotation

原文 2017-03-05 20:09:45 3 1 linux/ azure/ encryption/ azure-keyvault

So, lets say I've encrypted Linux VM on Azure (boy, the docs are awful). 所以，可以说我已经在Azure上加密了Linux VM（男孩，文档太糟糕了）。 How do I rotate the keys? 如何旋转按键？ Is it even possible? 可能吗？ Right now I see that Azure offers passphrase encryption. 现在，我看到Azure提供了密码加密。 I suppose you can't really "rotate" that? 我想你真的不能“旋转”那个吗？

But let's imagine I've used KEK (key encryption keys) to encrypt passphrase which is used to encrypt Linux VM, I don't think there's a way to rotate that except for remove encryption\\enable encryption? 但是，让我们想象一下，我已经使用KEK（密钥加密密钥）来加密用于加密Linux VM的密码，除了删除加密\\启用加密之外，我认为没有办法旋转它吗？

Am I missing something? 我想念什么吗？

vm encoded with Passphrase which is in turn encrypted with kek 使用Passphrase编码的vm，然后使用kek加密

1 个解决方案

Quote: 引用：

To rotate secrets, just call the same command you used originally to enable disk encryption, specifying a different Key Vault. 要旋转机密，只需调用最初用于启用磁盘加密的命令，并指定其他Key Vault。 To rotate the key encryption key, call the same command you used originally to enable disk encryption, specifying the new key encryption. 要旋转密钥加密密钥，请调用最初用于启用磁盘加密的相同命令，并指定新的密钥加密。

https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-faq#how-do-i-rotate-secrets-or-encryption-keys https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-faq#how-do-i-rotate-secrets-or-encryption-keys