is there a timelimit on a KEK to import BYOK into Azure Keyvault

Franck Marteaux 111

Is there a timelimit on the KEK to import BYOK from a customer HSM.
AWS has a timelimit of 24 hours for a similar process.

Since we have some issues importing keys, i want to make sure this is not the issue we are facing.

thanks and regards,
Franck

JamesTran-MSFT 36,621 Reputation points Microsoft Employee

2020-11-10T22:25:52.3+00:00

@Franck Marteaux
Thank you for your post!

-When referring to a time limit on the KEK, are you asking if there is an upload time limit? i.e. the operation cancels after 24hrs if the KEK isn't uploaded from an HSM?
-Or are you asking if there's a time limit to encrypt VMs, managed disks, etc, with a KEK?
-Is this KEK going to be used for encryption? i.e. Azure Disk Encryption, SSE+CMK, etc.
-Are you able to provide any additional details or documentation so I can gain a better understanding of your issue.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,621 Reputation points Microsoft Employee

2020-11-12T17:24:01.187+00:00

@Franck Marteaux
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
James Hamil 24,661 Reputation points Microsoft Employee

2020-11-26T00:18:22.727+00:00

Hi, do you still require assistance? If not, please mark the answer as verified.

Thank you,
James

Accepted answer

Franck Marteaux 111 Reputation points

2020-11-12T18:11:52.323+00:00

Hi James,
I think we figured it out.,
If you use a KEK with the "import" parameter to upload a BYOK from an HSM, you need to define an expiration.
But the expiration does not need to be 24 hours, e.g. we defined a date in 10 days which will give us enough time for the operation.

So, unlike AWS KMS, where the expiration seems to be a fixed 24 h, Azure KeyVault lets you define this timespan.

We will do the operation on Sunday, then I know if this worked...

Regards,
Franck
Please sign in to rate this answer.
JamesTran-MSFT 36,621 Reputation points Microsoft Employee

2020-11-13T00:24:34.83+00:00

@Franck Marteaux
Thank you for the quick follow up and I look forward to your response on whether or not everything worked.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

0 additional answers

Your answer