// Module included in the following assemblies:
//
// * machine_management/creating_machinesets/creating-machineset-gcp.adoc
// * machine_management/creating_machinesets/creating-machineset-azure-stack-hub.adoc
// * machine_management/control_plane_machine_management/cpmso_provider_configurations/cpmso-config-options-azure.adoc

:_mod-docs-content-type: PROCEDURE
[id="machineset-enabling-customer-managed-encryption-azure_{context}"]
= Enabling customer-managed encryption keys for a machine set

[role="_abstract"]
To enhance data security, enable customer-managed encryption on {azure-full} by adding the disk encryption set ID to your machine set.

You can supply an encryption key to {azure-short} to encrypt data on managed disks at rest. You can enable server-side encryption with customer-managed keys by using the Machine API.

An {azure-short} Key Vault, a disk encryption set, and an encryption key are required to use a customer-managed key. The disk encryption set must be in a resource group where the Cloud Credential Operator (CCO) has granted permissions. If not, an additional reader role is required to be granted on the disk encryption set.

.Prerequisites

* link:https://docs.microsoft.com/en-us/azure/aks/azure-disk-customer-managed-keys#create-an-azure-key-vault-instance[You created an {azure-short} Key Vault instance ({azure-short} documentation)].
* link:https://docs.microsoft.com/en-us/azure/aks/azure-disk-customer-managed-keys#create-an-instance-of-a-diskencryptionset[You created an instance of a disk encryption set ({azure-short} documentation)].
* link:https://docs.microsoft.com/en-us/azure/aks/azure-disk-customer-managed-keys#grant-the-diskencryptionset-access-to-key-vault[You granted the disk encryption set access to key vault ({azure-short} documentation)].

.Procedure

* Configure the disk encryption set under the `providerSpec` field in your machine set YAML file. For example:
+
[source,yaml]
----
providerSpec:
  value:
    osDisk:
      diskSizeGB: 128
      managedDisk:
        diskEncryptionSet:
          id: /subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Compute/diskEncryptionSets/<disk_encryption_set_name>
        storageAccountType: Premium_LRS
----

[role="_additional-resources"]
.Additional resources
* link:https://docs.microsoft.com/en-us/azure/virtual-machines/disk-encryption#customer-managed-keys[Customer-managed keys ({azure-short} documentation)]