使用 Azure CosmosDB 与存储进行端到端加密

Question

We develop a cloud based SaaS solution suitable for multiple tenants. For very sensitive data, we need to isolate tenants and provide end-to-end encryption for users assigned to this tenant. Not even the operators of the SaaS solution provider should be able to decrypt the data.

Azure Storage

I see that i could use the client-side encryption feature along with Azure Key Value for Azure Storage to accomplish this, allowing every tenant to provide a separate Azure KeyVault account which manages the encryption keys.

Azure Cosmos DB

As Azure Cosmos DB provides superior features regarding scalability, we would like to use Cosmos over Azure Storage. However, i didn't find a comparable feature for Cosmos DB providing end-to-end encryption capabilitys. The only Cosmos DB encryption feature i found is encryption at rest .

So my question is:

Is there a comparable feature for Azure Cosmos DB i could use to achieve the same goal (end-to-end encryption)?

Answer 1

I've got an answer from the Azure Cosmos DB Team on Twitter

Cosmos DB currently only supports encryption at rest and in transit. BYOK scenarios are on their roadmap .

Update: The Feature is now generally available .

Answer 2

In May 2020, Microsoft have made customer-managed-keys feature GA which means you can choose to add a second layer of encryption with keys you manage (customer-managed keys).

Note: This feature can be enabled only for New Azure Cosmos Accounts. Can't enable for existing accounts.

https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-setup-cmk

Answer 3

Is there a comparable feature for Azure Cosmos DB i could use to achieve the same goal (end-to-end encryption)?

Based on the encryption at rest , all user data stored in Cosmos DB is encrypted at rest and in transport, you don't have to take any action. But it is transparent for multi-tenants. So,if you want to implement end-to-end encryption which is similar to the Client-Side Encryption in Blob storage , you need to encapsulate your own encryption methods before the operations to your cosmos db data.

Moreover,if your data is formatted as files,I suggest you using Blob Storage because the cost of cosmos db is maybe a little higher.