Encryption with Azure Bob Storage v12 SDK for .Net

Question

i want to migrate my code to the v12 SDK , but how can i use Azure Keyvault?

There ist no BlobEncryptionPolicy class.

This tutorial is outdatet. It is still based on the old SDK.

v11 SDK Code:

// Retrieve the key that you created previously.
// The IKey that is returned here is an RsaKey.
var rsa = cloudResolver.ResolveKeyAsync(
            "https://contosokeyvault.vault.azure.net/keys/TestRSAKey1", 
            CancellationToken.None).GetAwaiter().GetResult();

// Now you simply use the RSA key to encrypt by setting it in the BlobEncryptionPolicy.
BlobEncryptionPolicy policy = new BlobEncryptionPolicy(rsa, null);
BlobRequestOptions options = new BlobRequestOptions() { EncryptionPolicy = policy };

// Reference a block blob.
CloudBlockBlob blob = contain.GetBlockBlobReference("MyFile.txt");

// Upload using the UploadFromStream method.
using (var stream = System.IO.File.OpenRead(@"C:\Temp\MyFile.txt"))
    blob.UploadFromStream(stream, stream.Length, null, options, null);

Answer 1

Regarding the issue, please refer to the following steps. For more details, please refer to here .

1. Create a Service principal and set access policy in Azure key vault fro the sp

2. Code (Install package ``)

 string tenantId = "<sp tenant>";
            string clientId = "<sp appId>";
            string clientSecret = "<sp secret>";
            string connectionString = "";
            ClientSecretCredential cred = new ClientSecretCredential(tenantId, clientId, clientSecret);
            var vaultUri = new Uri("https://jimkey02.vault.azure.net/");
            KeyClient keyClient = new KeyClient(vaultUri, cred);  
            // if you do not have key, please use following code to create
            //KeyVaultKey rasKey = await keyClient.CreateRsaKeyAsync(new CreateRsaKeyOptions("blobKey"));
            KeyVaultKey rasKey = await keyClient.GetKeyAsync("blobKey", "<key version>");
            IKeyEncryptionKey key =new CryptographyClient(rasKey.Id, cred);
            IKeyEncryptionKeyResolver keyResolver = new KeyResolver(cred);
            ClientSideEncryptionOptions encryptionOptions = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V1_0)
            {
                KeyEncryptionKey = key,
                KeyResolver = keyResolver,
                // string the storage client will use when calling IKeyEncryptionKey.WrapKey()
                KeyWrapAlgorithm = "RSA1_5"
            };

            BlobClientOptions options = new SpecializedBlobClientOptions() { ClientSideEncryption = encryptionOptions };
            BlobClient blob = new BlobServiceClient(connectionString, options).GetBlobContainerClient("test").GetBlobClient("test.txt");
            using (FileStream file = File.OpenRead(@"D:\test.txt"))
            {
                await blob.UploadAsync(file);
            }


            BlobDownloadInfo download = await blob.DownloadAsync();
            using (StreamReader reader = new StreamReader(download.Content)) {
                string text = await reader.ReadToEndAsync();
                Console.WriteLine(text);
            }